Submission Details
Severity:
Potential Reentrancy in Short Record Deletes
Summary
Deleting short records via deleteShortRecord can be vulnerable to reentrancy.
Vulnerability Details
deleteShortRecord calls external contracts to burn NFTs. If these are malicious, they could reenter before state is updated.
For example:
function deleteShortRecord(address asset, address account, uint8 id) external {
NFT(tokenId).burn();
// Vulnerable to reentry here
delete shortRecords[asset][account][id];
}
Impact
Reentrancy could prevent record delete or cause unexpected side effects..
Tools Used
Manual
Recommendations
Use checks-effects-interactions pattern
Add reentrancy guard
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.