Flow

Summary

The batch function in Batch.sol uses delegatecall to execute multiple calls in a single transaction, which could allow unintended state changes if arbitrary functions are executed. Without strict access control, this creates a risk of bypassing safeguards within each individual function.

Vulnerability Details

The batch function uses delegatecall within a loop, allowing multiple state-altering functions to be called:

An attacker could exploit this by calling both deposit and withdraw in a single batch, potentially bypassing function-specific checks.

Impact

Exploiting batch processing could lead to:

1. Double-spending or bypassing individual function controls.

2. Manipulation of balances, causing financial discrepancies.

Tools Used

Manual code review

Recommendations

Restrict batch calls to a whitelist of approved functions or add granular access control checks to prevent arbitrary function execution.