Submission Details
Severity:
Reentrancy via address.call{}
Summary
It's possible to reenter selectWinner() function when funds are sent, thus draining any of the fees stored.
Vulnerability Details
If the caller of selectWinner() is a contract, it can be used to reenter the function. If there are any stored funds in the contract because the owner has not withdrawn their fees, these can be drained each time the user re-enters the contract.
Impact
Medium
Tools Used
Manual review
Recommendations
Add a non-reentrant modifier to the function to ensure this behavior is not possible.
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.