The 'compound' function calls external contracts which potentially leads to reentrancy attacks
Summary
The compound function transfers tokens and interacts with external contracts (swap and add liquidity operations). If those contracts are not secure, they could potentially call back into this contract leading to reentrancy attacks. However, this risk is mitigated if the external contracts are trusted and do not have any callbacks.
Vulnerability Details
The function calls external contracts (tokenA, tokenB, GMXManager) which could be manipulated by an attacker to re-enter the function before the first call is finished.
Impact
An attacker could potentially drain the contract of funds by causing the function to be called recursively before the first call is finished.
Tools Used
Slither, Manual Review
Recommendations
Use the Checks-Effects-Interactions pattern to prevent reentrancy attacks. Try to make any state changes before calling external contracts.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.