stake.link

Summary

Missing non-reentrant modifier in handleOutgoingRESDL and withdraw function

Vulnerability Details

A potential reentrancy attack can be executed in these functions due to the sdlToken.safeTransfer external call made

Impact

This can cause unauthorized withdrawal in withdraw function

Tools Used

VS Code

Recommendations

A modifier of the form below can mitigate the issue:
bool private locked;

modifier nonReentrant() {
require(!locked, "ReentrancyGuard: reentrant call");
locked = true;
_;
locked = false;
}

// Example usage in a function
function myFunction() external nonReentrant {
// ... (state changes)
externalContract.someFunction(); // External call after state changes
// ...
}