Summary

The delete accountTokens[user] deletes the user itself and not the tokens held by the user. It can be drained out using reentrancy.

Vulnerability Details

By deploying another contract with payable fallback function, reentrancy attack can be initiated on this delete accountToken[user] in function fixUser.

Impact

Before destroying/burning all the token when liquidation is initiated, It can be attacked by other reentrancy contract, and all the liquisity token instead of burning, will get transferred to attackers contract address.

Tools Used

Foundry fuzz test

Recommendations

1. using reentrancy for fixUserFunction.

2. Create a mapping for accountTokens(address => uint) tokens. And delete the tokens.