Submission Details
Severity:
Exposure to reentrancy in DaiGoldAuction::bid as state is not effectively updated
## Vulnerability Details
In any situation that the `bidtoken` is set to an asset with a callback mechanism, an attacker would be able to carry out a reentrancy as state is not properly updates.
```
function bid(uint256 amount) external virtual override onlyWhenLive {
if (amount == 0) { revert CommonEventsAndErrors.ExpectedNonZero(); }
bidToken.safeTransferFrom(msg.sender, treasury, amount);
uint256 epochIdCache = _currentEpochId;
depositors[msg.sender][epochIdCache] += amount;
EpochInfo storage info = epochs[epochIdCache];
info.totalBidTokenAmount += amount;
emit Deposit(msg.sender, epochIdCache, amount);
}
```
## Tools Used
Manual Review
## Recommendations
Update state correctly by following Checks Effects Interaction.
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.