Reentrancy in `Dussehra.withdraw()`
Summary
Reentrancy in Dussehra.withdraw()
Vulnerability Details
External calls:
- (success) = msg.sender.call{value: amount}() (src/Dussehra.sol#86)
State variables written after the call(s):
- totalAmountGivenToRam = 0 (src/Dussehra.sol#88)
Impact
Funds Drain: If the state update (totalAmountGivenToRam = 0;) occurred after the call to msg.sender.call{value: amount}("");, an attacker could exploit this by re-entering the function and repeatedly withdrawing funds.
Tools Used
Manual review
Recommendations
Use reentrancy guards (nonReentrant modifier from OpenZeppelin).
Lead Judging Commences
Invalid - reentrancy in withdraw
The `withdraw` function sends the given amount to Ram. If the attacker calls the `withdraw` function again before the state variable is changed, the function will revert because there are no more funds in the contract. This reentrancy has no impact for the protocol. It is recommended to follow the CEI pattern, but this is informational.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.