Submission Details
Severity:
Lack of State Updates Before External Calls
Description:
Location in Code: The
endandwithdrawfunctions.State variables are sometimes updated after making external calls.
If the external call fails or is exploited, the state may not reflect the correct status.
Impact:
The contract's state may be inconsistent, leading to vulnerabilities or loss of funds.
Proof of Code :
fn end(ref self: ContractState) {
// ...
// External call made before state update
erc721_dispatcher.safe_transfer_from(sender, recipient, self.nft_id.read().into());
self.ended.write(true); // State updated after external call
// ...
}
Recommendation:
Update state before external calls.
Reorder code to ensure state reflects the intended action before any external interaction.
Corrected Code:
fn end(ref self: ContractState) {
// ...
self.ended.write(true); // State updated before external call
erc721_dispatcher.safe_transfer_from(sender, recipient, self.nft_id.read().into());
// ...
}
Rewards breakdown
nSLOC
132This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.