Christmas Dinner

Vulnerability Details

The refund() function uses a nonReentrant modifier to prevent reentrancy. However, the modifier resets locked = false after the function execution. If an attacker finds a way to bypass the nonReentrant lock (e.g., via a malicious contract or external calls), they could repeatedly call the function and drain funds.

Impact

An attacker could repeatedly trigger the refund() function, draining assets or causing unexpected state changes.

Poc

1. Deploy a malicious contract that interacts with refund():

1. Call the attack() function from the malicious contract.

2. Observe that the funds are drained because reentrancy prevention is not robust.

Recommendation

• Use OpenZeppelin's ReentrancyGuard directly for better security practices.

• Ensure that external calls (_refundETH or _refundERC20) are made after state updates.

• Follow the Checks-Effects-Interactions (CEI) pattern strictly.