Christmas Dinner

Summary

The _refundERC20 function in the ChristmasDinner contract transfers ERC20 tokens to the user before updating their balance to zero. This introduces a reentrancy vulnerability because the external call to safeTransfer allows the recipient to re-enter the contract before the balance is reset. If exploited, this can drain the entire contract balance.

Vulnerability Details

The _refundERC20 function in the ChristmasDinner contract allows the recipient to re-enter the contract during the token transfer process. The balance is updated after the safeTransfer calls, leaving the contract vulnerable to reentrancy attacks. An attacker can exploit this by repeatedly calling the refund() function, draining ERC20 tokens from the contract before the balances are reset. This results in the potential loss of all funds stored in the contract.

Impact

• Attackers can repeatedly call the refund() function through a fallback or receive function.

• This could result in the attacker draining all ERC20 tokens from the contract.

• The contract’s funds can be entirely compromised, causing a significant financial loss.

Tools Used

Foundry

Recommendations