Christmas Dinner

Summary

The nonReentrant modifier's implementation is flawed as it fails to set the locked state variable to true at the beginning of the function execution. This creates a window of vulnerability where reentrancy attacks could be possible.

Vulnerability Details

The nonReentrant modifier fails to set the locked variable to true before the function execution, allowing a reentrancy attack. This oversight creates a window where an attacker can re-enter the function and exploit the vulnerability, potentially draining funds or causing other unintended actions. The lack of proper locking makes critical functions like refund() susceptible to exploitation.

Impact

Potential reentrancy attacks could drain funds from the contract
Multiple simultaneous calls to protected functions could succeed
Critical functions like refund() are not properly protected

Tools Used

Foundry

Recommendations

Implement the reentrancy guard correctly by setting the lock before function execution: