Missing Reentrancy Guards in performUpkeep()
Summary
The performUpkeep(bytes _performData) function in the LSTRewardsSplitterController contract lacks reentrancy guards, exposing it to potential read-only reentrancy attacks.
Vulnerability Details
In the performUpkeep() function, external calls are made to splitters[accounts[i]].performUpkeep(""). Without appropriate reentrancy protection, this allows an external contract to interact back with the original contract before its execution completes.
Impact
Failure to implement reentrancy guards can lead to unexpected behavior, including the risk of stale data being read and manipulated during the execution of external calls, potentially compromising the contract's integrity.
Tools Used
Manual code review
Recommendations
Apply a reentrancy guard (such as the nonReentrant modifier from OpenZeppelin) to the performUpkeep() function to prevent unintended reentrant calls.
Line Reference: LSTRewardsSplitterController.sol, Line: 99
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.