First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Reentrancy Vulnerability in withdraw Function

darshan

Summary

The withdraw function in the given contract is vulnerable to a reentrancy attack. This vulnerability allows an attacker to recursively call the withdraw function before the initial function execution completes, potentially draining the contract of its funds.

Vulnerability Details

A reentrancy attack occurs when a contract calls an external contract before it updates its state. This allows the external contract to make a recursive call back to the original function, potentially exploiting the contract's state before it is updated.

Affected Function
The withdraw function is susceptible to this vulnerability due to the order of operations:

function withdraw() public RamIsSelected OnlyRam RavanKilled {
if (totalAmountGivenToRam == 0) {
revert Dussehra__AlreadyClaimedAmount();
}
uint256 amount = totalAmountGivenToRam;
(bool success, ) = msg.sender.call{value: amount}("");
require(success, "Failed to send money to Ram");
totalAmountGivenToRam = 0;
}

Impact

An attacker can drain the contract’s funds by repeatedly calling the withdraw function before the state is updated, leading to significant financial loss.

Tools Used

Manual

Recommendations

Update State Before External Call: Change the order of operations to update the state before making the external call.
Use Mutex/Guard: Implement a guard to prevent reentrancy.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Invalid - reentrancy in withdraw

The `withdraw` function sends the given amount to Ram. If the attacker calls the `withdraw` function again before the state variable is changed, the function will revert because there are no more funds in the contract. This reentrancy has no impact for the protocol. It is recommended to follow the CEI pattern, but this is informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.