Submission Details
Severity:
REENTRANCY_IN_REFUND
Summary
Reentrancy in refund function before the state variable update allows to withdraw funds from the contract
Vulnerability Details
In refund function calls msg.sender back with no gas limits. Reentrancy occurred before state variable players changed. This allows attacker to call refund function back again and withdraw all the funds from the contract
Impact
Funds withdrawing possibility
Tools Used
Recommendations
Transfer ether back after all the state variables updated
Updates
Lead Judging Commences
Hamiltonite almost 2 years ago
Submission Judgement Published Assigned finding tags:
reentrancy-in-refund
reentrancy in refund() function
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.