Zaros Part 1

Summary

deposit more than the cap using reentrancy (and ERC777) by depositing in the erc777 callback

Vulnerability Details

if an acount wants to deposit more than the allowed cap he can!
just you a callback token (erc777 or erc20 with pugins) and when you get the callback just deposit again

the "totalDeposited" only change in the internal deposit function after the callback so you can repeat as much as you want

src/perpetuals/branches/TradingAccountBranch.sol Line 346 and Line 349

Impact

deposit more than the DepositCap

Tools Used

None

Recommendations

change the order of operations