GivingThanks

Summary

GivingThanks::donate function makes an external call to send ether before performing checks protect itself from reentrancy attack. This can be exploited if the address of the receiver is a Smart Contract and implements a payable callback function

Vulnerability Details

**A reentrancy attack is when the execution flow is transferred to an external contract, usually via an external call **e.g. a “fallback” function , allowing the function (or another function) to be called recursively.

Impact

A malicious charity can mint itself infinite amount of NFTs by repeatedly donating to itself in it's fallback function.

Tools Used

Manual review.

Recommendations

Mutexes or locks can be implemented. Another solution is to use a third party library code with modifier function for protection, e.g. ReentrancyGuard from OpenZeppelin with it's nonReentrant modifier. For extensive information you can refer to https://www.cyfrin.io/blog/what-is-a-reentrancy-attack-solidity-smart-contracts .