The Standard

Summary

Reentrancy attack in getAssets() function if getAssetBalance() function makes external call

Vulnerability Details and Impact

• Attacker contract calls getAssets(), which in turn calls getAssetBalance()

• getAssetBalance() makes an external call to the attacker contract

• Attacker contract's fallback function calls getAssets() again

• Step 1-3 repeat, resulting to an infinite loop

Recommendations

• Perform state changes before making external calls:
  -- Calculate the asset balance before making the call to getAssetBalance(). This CEI pattern means that the state of getAssets() function has already been updated in the events that there is a reentrancy.

• Utilize Reentrancy Guards