stake.link

Summary

Possible reentrancy attack in distributeRewards() function

Vulnerability Details

In the distributeRewards() function of the smart contract, a reentrancy attack could occur if the ISDLPoolPrimary(sdlPool).withdrawRewards(tokens); line calls an external contract that has a fallback function or a callback function.

Impact

If this external contract is malicious or poorly designed, it could call back into the distributeRewards() function before the state of the distributeRewards() function has been fully updated. This could lead to unexpected behavior or potential loss of funds.

Recommendations

Perform all external calls at the end of the function, after the state has been fully updated. This ensures that even if the external call causes the function to be called again, it won't affect the current execution of the function.