Lack of Reentrancy Protection in Escrow contract
Hello ArkProject,
The _depositIntoEscrow and _withdrawFromEscrow functions interact with external contracts (IERC721.transferFrom and IERC1155.safeTransferFrom). These functions could potentially introduce reentrancy vulnerabilities if the external contract being called is malicious and attempts to re-enter the contract before the state changes (like updating the _escrow mapping) are completed.
Mitigation: Implement a reentrancy guard (e.g., using the nonReentrant modifier) to prevent reentrant calls from occurring during token transfers.
Lead Judging Commences
finding-withdraw-reentrancy-creates-unbridgeable-tokens
Impact: - NFT already bridged won’t be bridgeable anymore without being stuck. Likelyhood: Low. - Attackers will corrupt their own tokens, deploying a risky contract interacting with an upgradable proxy. They have to buy and sell them without real benefits, except being mean. Some really specific and rare scenario can also trigger that bug.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.