Line: https://github.com/Cyfrin/2024-08-fjord/blob/6614c7f97f6fb020f1a980215e7579615027ba8e/src/FjordAuction.sol#L159

The unbid function allows users to withdraw their bid before the auction ends. However, this function transfers tokens back to the user (fjordPoints.transfer(msg.sender, amount)) before updating the user's bid balance (bids[msg.sender] = bids[msg.sender].sub(amount)).

• Risk: A malicious user could reenter the unbid function before their balance is updated, potentially withdrawing more tokens than they initially bid.

• Solution: To prevent reentrancy, the contract should update the user's bid balance before making the token transfer, or alternatively, use the ReentrancyGuard modifier from OpenZeppelin.