First Flight #9: Soulmate

Summary

Vault :: InitVault() is used approve its corresponding management contract to handle tokens. vaultInitialize protect against multiple initialization.

Vulnerability Details

The InitVault() function is not properly follows checks effects pattern . This allows an attacker to call InitVault() multiple times.

Code Snippet

    function initVault(ILoveToken loveToken, address managerContract) public {
    if (vaultInitialize) revert Vault__AlreadyInitialized();
    @audit-issue : Lack of CEI.
    loveToken.initVault(managerContract);
    vaultInitialize = true;
  }

Impact

The impact is that vault can be initialized multiple times.

Tools Used

Manual check

Recommendations

Try to write this function like this.

    function initVault(ILoveToken loveToken, address managerContract) public {
    if (vaultInitialize) revert Vault__AlreadyInitialized();
    vaultInitialize = true;
    loveToken.initVault(managerContract);
  }