Trick or Treat

Description: The resolveTrick function transfers an NFT to the caller before cleaning up the storage related to pending NFTs. This sequence can potentially allow reentrancy attacks if the transferred NFT triggers a fallback function in a malicious contract.

• Found in src/TrickOrTreat.sol Line: 131

  _transfer(address(this), msg.sender, tokenId);

Impact: An attacker could exploit this by repeatedly calling resolveTrick through a fallback function, potentially leading to unauthorized access or manipulation of the contract state

Proof of Concept:

• Scenario: A malicious contract calls resolveTrick and uses a fallback function triggered by the NFT transfer to re-enter the function before storage cleanup.

• Exploit: The attacker could manipulate the contract state or drain resources by exploiting the reentrancy vulnerability.

Recommended Mitigation:

• Reorder the function logic to update the contract state before making any external calls.

• Ensure that the nonReentrant modifier is effectively used to prevent reentrant calls.