Submission Details
Severity:
Possibility of Reentrancy Attack
Summary
The claimAllRewards and claimSingleReward functions are both susceptible to a reentrancy attack.
Vulnerability Details
Within both functions when a user claims, the value is sent to them via call() before the user's rewardsOwned state has been updated. If the claimer is a smart contract it can recursively reenter the function via fallback() or recieve().
Impact
This will allow the caller to deplete the contract of its entire token balance.
Tools Used
Manual Review
Recommendations
Use the check-effects-interactions pattern or the nonReentract modifier.
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
`claimAllRewards` reentrancy
`claimSingleReward` reentrancy
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.