Submission Details
Severity:
Potential Reentrancy in tillIn
Summary
The tillIn function interacts with external contracts in a way that could potentially lead to reentrancy attacks.
Vulnerability Details
IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}();
_safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);
This sequence of operations interacts with an external contract before completing its state changes.
Impact
While unlikely with standard WETH implementations, a malicious or upgraded wrappedNativeToken contract could potentially reenter the tillIn function, leading to unexpected behavior or fund drainage.
Tools Used
manual code review
Recommendations
Include a reentrancy guard and follow the checks-effects-interactions pattern by updating state before interacting with external contracts
import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
contract TokenManager is ReentrancyGuard, ... {
function tillIn(...) external payable nonReentrant {
// ... existing code ...
}
}
Prize pool breakdown
Total prize
27,750 USDC
nSLOC
1,22923 USDC / LOC
25,000 USDC
2,750 USDC
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.