Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Improper Implementation of NonReentrant Modifier Makes It Ineffective

icon0x

Vulnerability Details

The nonReentrant modifier is intended to prevent reentrancy attacks by using a locked variable. However, in the ChristmasDinner contract, the locked variable is not set to true before executing the function body (_;). As a result, the modifier fails to block reentrant calls effectively, leaving the contract vulnerable to attacks.

Here is the vulnerable code:

modifier nonReentrant() {
require(!locked, "No re-entrancy");
//missing setting locked to true, to prevent reentrancy attack.
_;
locked = false;
}

Impact

The incorrect implementation of the nonReentrant modifier undermines its intended protection, leaving the contract potentially vulnerable to reentrancy attacks if its logic is modified in the future.

Recommended Mitigation

To fix this issue, consider the below nonReentrant modifier.

modifier nonReentrant() {
require(!locked, "No re-entrancy");
+ locked = true;
_;
locked = false;
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

mutex lock incomplete

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!