LiquidationPool.decreasePosition Reentrancy
Summary
Due to EUROs and TST tokens being out of scope, combined with the vulnerability to reentrancy attacks in the decreasePosition function, it is possible to drain all the funds from the contract depending on the implementation of these tokens, both currently and in future modifications.
Vulnerability Details
The function updates the storage after making an external call to the tokens. This poor practice becomes critical if developers decide to implement hooks in the current or future implementations of EUROs and TST tokens.
Impact
Complete drainage of the contract.
Tools Used
Manual Review
Recommendations
Follow the Check-Effects-Interactions (CEI) best practices.
Lead Judging Commences
informational/invalid
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.