Vulnerability To Reentrancy Attack In Refund() Method
Summary
The refund() method of the contract refunds users by accepting a player index as input, and then refunding the user the entrance fee.
Vulnerability Details
The method will refund a user first, and then disable refunding afterwards. This leaves the contract vulnerable to a reentrancy attack. If a user invokes this method repeatedly, without allowing it to finish, the user will be able to drain the contract of all of its funds.
Impact
All of the funds held by the contract.
Tools Used
Solidity
Recommendations
Reformat the refund method so that a users' ability to refund is disabled before refunding the user. Use openzeppelins reentrancy guard protection.
Lead Judging Commences
reentrancy-in-refund
reentrancy in refund() function
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.