Submission Details
Severity:
Use a nonReentrant modifier in _deployFunds function
Summary
The _deployFunds function calls transmuter.deposit, which is an external function. Without proper precautions, this can open the function to a read-only reentrancy attack, where the state could be manipulated in an unexpected way before the external call completes.
https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyMainnet.sol#L80
Impact
Suppose a function (_deployFunds) calls an external contract like transmuter.deposit.
If transmuter.deposit allows a callback to another function in this contract, the attacker can call a view function balanceDeployed before _deployFunds completes its state changes.
Tools Used
Manual
Recommendations
Use a nonReentrant modifier to prevent reentrancy attacks.
import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
contract StrategyMainnet is BaseStrategy, ReentrancyGuard {
function _deployFunds(uint256 _amount) internal override nonReentrant {
transmuter.deposit(_amount, address(this));
}
}
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366 OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.