Submission Details
Severity:
Possible reentrancy in `_claimPlenty()`
Summary
An attacker might claim several times with _claimPlenty().
Vulnerability Details
function _claimPlenty(address account) internal {
// Plenty is earned in the form of the sop token.
uint256 plenty = s.a[account].sop.plenty;
IWell well = IWell(s.sopWell);
IERC20[] memory tokens = well.tokens();
IERC20 sopToken = tokens[0] != C.bean() ? tokens[0] : tokens[1];
sopToken.safeTransfer(account, plenty);
delete s.a[account].sop.plenty;
emit ClaimPlenty(account, address(sopToken), plenty);
}
In _claimPlenty(), it deletes s.a[account].sop.plenty after transfer the funds. If sopToken has a hook, users can claim as much as they like using reentrancy.
Impact
Possible fund loss using _claimPlenty() using reentrancy.
Tools Used
Manual Review
Recommendations
It should delete s.a[account].sop.plenty first before starting the transfer.
Updates
Lead Judging Commences
giovannidisiena over 1 year ago
Submission Judgement Published Reason: Incorrect statement
Assigned finding tags:
Informational/Invalid
Prize pool breakdown
Total prize
100,000 USDC
nSLOC
5,77617
USDC / LOC
95,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.