First Flight #21: KittyFi

Summary

The whiskdrawMeowllateral function executes a withdrawal via an external call to the IKittyVault contract before verifying that the caller has sufficient collateral. This sequence allows for reentrancy attacks where an attacker can re-enter the contract and withdraw more funds than intended.

Vulnerability Details

In the whiskdrawMeowllateral function, the call to IKittyVault(tokenToVault[_token]).executeWhiskdrawal is performed before the require check that ensures the caller has enough collateral. This opens up the function to a reentrancy attack, allowing the attacker to recursively call the whiskdrawMeowllateral function and drain funds.

Code Snippet

Impact

An attacker can exploit this vulnerability to:

1. Drain the funds from the contract by re-entering the function multiple times.

2. Cause the contract to behave unexpectedly, leading to potential financial loss and instability.

Tools Used

Manual

Recommendations

To mitigate this vulnerability, follow the Checks-Effects-Interactions pattern by moving the require check before the external call. Here is the revised function:

By reordering the checks and the external call, the function ensures that the state is validated before interacting with external contracts, effectively preventing reentrancy attacks.