Christmas Dinner

Description:
In the nonReentrant modifier, the state variable locked is reset to false at the end of the function execution. If there’s any uncaught exception, locked might not reset properly, causing a deadlock in the contract.

Impact:

If locked remains true due to an unexpected exception, the contract might get stuck, and further calls to protected functions will fail permanently.

POC

1.Create an external call that forces an exception after the refund() logic but before locked resets.

2.Observe that locked remains true and prevents any further interactions with the function.

Recommendation:

Use OpenZeppelin's ReentrancyGuard instead of a custom modifier.
Ensure all paths, including exceptions, reset the locked state properly using try/catch blocks.