The Standard

Summary

In decreasePosition when we transfer the value either tstToken or euroToken in contract their is very common and well know issue , which is first external call then update the values which make it variable to security issues , like Reentrancy.

Vulnerability Details

Reentrancy which allow user to take some token amount more then he own.

You can clearly see you make external call then you update the storage in secure case it should update first then it will transfer amount , to secure future security isseus.

            // @audit-info renterency attack  maybe occur please  update stated before transfer the amount
            IERC20(TST).safeTransfer(msg.sender, _tstVal);
            positions[msg.sender].TST -= _tstVal;
        }
        if (_eurosVal > 0) {
            // @audit-info renterency attack  maybe occur please  update stated before transfer the amount

            IERC20(EUROs).safeTransfer(msg.sender, _eurosVal);
            positions[msg.sender].EUROs -= _eurosVal;
        }

Impact

Maybe withdraw all token from then contract which happen in past with many contracts.

Tools Used

myth and manual Review

Recommendations

Update storage then transfer the amount.