Submission Details
Severity:
Functions calling tokens with transfer hooks are missing reentrancy guards
Summary
Functions that call contracts or addresses with transfer hooks should use reentrancy guards for protection.
Even if these functions adhere to the check-effects-interaction best practice, absence of reentrancy guards can expose the protocol users to read-only reentrancies.
Without the guards, the only protective measure is to block-list the entire protocol, which isn't an optimal solution.
Vulnerability Details
File: contracts/Distribution.sol
/// @audit function `_stake()`
204: IERC20(depositToken).safeTransferFrom(_msgSender(), address(this), amount_);
/// @audit function `_withdraw()`
278: IERC20(depositToken).safeTransfer(user_, amount_);
/// @audit function `bridgeOverplus()`
327: IERC20(depositToken).safeTransfer(l1Sender, overplus_);
Updates
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.