Summary

Vulnerability Details

Issue: Reentrancy Risk in Fund Management Functions

The following functions are vulnerable to reentrancy attacks:

1. _deployFunds(uint256 _amount)

   • Calls transmuter.deposit(), which interacts with an external contract. Without a reentrancy guard, a malicious contract could exploit this by calling back into the function before state updates are complete.

2. claimAndSwap(uint256 _amountClaim, uint256 _minOut, uint256 _routeNumber)

   • This function involves external interactions with the transmuter.claim() and a Curve Router via router.exchange(). The absence of a guard allows attackers to recursively exploit state changes and drain funds.

3. _freeFunds(uint256 _amount)

   • Calls transmuter.withdraw(), which is another external interaction prone to reentrancy risks.

Impact

The vulnerability poses a high severity risk with the following potential impacts:

1. Fund Theft: Malicious actors could recursively call vulnerable functions to withdraw more funds than intended.

2. State Corruption: Incomplete execution of state changes could lead to inconsistencies in balances and other critical contract variables.

3. Ecosystem Exploitation: If deployed on mainnet, the issue could damage user trust and result in significant financial losses for the protocol.

Example Scenario:

• A malicious contract calls claimAndSwap() to initiate a token swap, then recursively invokes itself during external calls to withdraw more funds than permitted.

Tools Used

Recommendations

Implement Reentrancy Guard:
Add OpenZeppelin’s ReentrancyGuard to the contract and apply the nonReentrant modifier to all vulnerable functions.