The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`mint` and `burn` functions in the contract lack proper reentrancy protection, exposing contract to potential reentrancy attacks.

0xVinylDavyl

Summary

The mint and burn functions in the SmartVaultV3 contract lack proper reentrancy protection, which exposes the contract to potential reentrancy attacks. This vulnerability could lead to unexpected behavior and possible loss of funds.

Vulnerability Details

The mint and burn functions perform state modifications and interact with external contracts (EUROs and ERC-20 tokens) without implementing the ReentrancyGuard pattern. This makes the contract susceptible to reentrancy attacks, where an external malicious contract could repeatedly invoke these functions before state changes are finalized, leading to unexpected outcomes.

Impact

function mint(address _to, uint256 _amount) external onlyOwner ifNotLiquidated {
uint256 fee = _amount * ISmartVaultManagerV3(manager).mintFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
require(fullyCollateralised(_amount + fee), UNDER_COLL);
minted = minted + _amount + fee;
EUROs.mint(_to, _amount);
EUROs.mint(ISmartVaultManagerV3(manager).protocol(), fee);
emit EUROsMinted(_to, _amount, fee);
}
​
function burn(uint256 _amount) external ifMinted(_amount) {
uint256 fee = _amount * ISmartVaultManagerV3(manager).burnFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
minted = minted - _amount;
EUROs.burn(msg.sender, _amount);
IERC20(address(EUROs)).safeTransferFrom(msg.sender, ISmartVaultManagerV3(manager).protocol(), fee);
emit EUROsBurned(_amount, fee);
}

Unauthorized Fund Withdrawals:

Malicious actors can exploit the reentrancy vulnerability to repeatedly call the mint function, allowing them to withdraw EUROs tokens and potentially drain the contract's balance.
Manipulation of Contract State:

Reentrancy attacks can lead to the manipulation of the contract's state during execution. Attackers can interfere with the intended flow of operations, potentially causing unexpected behavior and disruptions in the SmartVault's functionality.
Financial Losses:

If successfully exploited, the vulnerability can result in substantial financial losses for the SmartVault and its users. Unauthorized fund withdrawals and manipulated state could lead to irreversible financial harm.
Disruption of Contract Logic:

Reentrancy attacks can disrupt the normal execution flow of the contract, causing unintended consequences. This may impact the overall reliability and functionality of the SmartVaultV3 contract.

Tools Used

Manual

Recommendations

Implement the ReentrancyGuard pattern in the affected functions (mint and burn) to prevent reentrancy attacks. Additionally, ensure that state modifications are consistently performed after external calls to maintain the integrity of the contract's state.

Recommended Mitigation Steps

Implement ReentrancyGuard in affected functions:

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
​
contract SmartVaultV3 is ISmartVault, ReentrancyGuard {
// Existing contract code
​
modifier onlyVaultManager {
require(msg.sender == manager, INVALID_USER);
_;
}
​
modifier onlyOwner {
require(msg.sender == owner, INVALID_USER);
_;
}
​
modifier ifMinted(uint256 _amount) {
require(minted >= _amount, "err-insuff-minted");
_;
}
​
modifier ifNotLiquidated {
require(!liquidated, "err-liquidated");
_;
}
​
// Existing contract code
}

Ensure state modifications are done after external calls:

function mint(address _to, uint256 _amount) external onlyOwner ifNotLiquidated nonReentrant {
// Existing code
​
minted = minted + _amount + fee;
EUROs.mint(_to, _amount);
EUROs.mint(ISmartVaultManagerV3(manager).protocol(), fee);
emit EUROsMinted(_to, _amount, fee);
}
​
function burn(uint256 _amount) external ifMinted(_amount) nonReentrant {
// Existing code
​
minted = minted - _amount;
EUROs.burn(msg.sender, _amount);
IERC20(address(EUROs)).safeTransferFrom(msg.sender, ISmartVaultManagerV3(manager).protocol(), fee);
emit EUROsBurned(_amount, fee);
}
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.