Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

REENTRANCY_IN_PROCESS_DEPOSIT_CANCELLATION

asimaranov

Summary

Reentrancy in processDepositCancellation before state update

Vulnerability Details

In processDepositCancellation, user is called before status update:

if (self.depositCache.depositParams.token == address(self.WNT)) {
...
(bool success, ) = self.depositCache.user.call{value: address(this).balance}("");
...
}
​
...
​
self.status = GMXTypes.Status.Open;
​

If self.depositCache.user is a smartcontract with receive function, it can call protocol back while it's status is not updated e.g. cancel deposit again.

Functions that use processDepositCancellation like GMXVault.processDepositCancellation has no nonReentrant modifier

Impact

Double deposit cancellation possibility

Tools Used

Recommendations

Withdraw ether when state is consistent. Add nonReentrant to functions that work with logic can be impacted by reentrancy

Updates

Lead Judging Commences

hans Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Reentrancy by keepers

Impact: High Likelihood: Low The only possible external caller is the keepers. But this is still a vulnerability and it is strongly recommended to implement CEI pattern. Given the limited impact, similar issues (reentrancy by keepers) are grouped.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.