First Flight #13: Baba Marta

Vulnerability Details

The joinEvent function allows external calls before completing internal state changes, which could potentially lead to reentrancy attacks. There's a potential indirect reentrancy vulnerability depending on how the _healthToken contract behaves.

Tools Used

Remix IDE and manual inspection

Recommendations

Ensure that all internal state changes are made before external calls
function joinEvent() external {
...
_addProducer(msg.sender);
(bool success) = _healthToken.transferFrom(msg.sender, address(this), healthTokenRequirement);
require(success, "The transfer is not successful");
}