Project

Summary

If msg.sender is a contract with a custom implementation of IERC20.safeTransferFrom, During safeTransferFrom, this malicious contract could re-enter the sendProfit function before the function completes.

When sendProfit calls safeTransferFrom(msg.sender, address(this), amount);, control is temporarily transferred to msg.sender’s safeTransferFrom function. If msg.sender is a malicious contract, it can use this transfer of control to execute a callback function. This callback could then re-enter sendProfit, bypassing any state changes or validations that would typically occur after safeTransferFrom.

Thus manipulating the distribution of profits and potentially inflate the profit-per-token value

##PoC

1. A malicious contract (acting as msg.sender) calls sendProfit.

2. Inside sendProfit, the safeTransferFrom function is called to transfer tokens from msg.sender to the contract.

3. Since msg.sender is a contract, it can include custom code that triggers a callback during the safeTransferFrom execution.

4. This callback re-enters sendProfit, causing it to execute its logic multiple times without completing the initial transaction.

Tools Used

Recommendations

Use a nonReentrant modifier