Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Reentrancy Vulnerability in `_refundETH` Function

shrxyeh

Summary

The _refundETH function transfers ETH to the user before updating their balance to zero. This creates a reentrancy vulnerability because the external call _to.transfer(refundValue) allows the recipient to re-enter the contract before their balance is set to zero. Additionally, the use of .transfer has a fixed gas limit of 2300, which can cause transactions to fail if more gas is required.

Vulnerability Details

The _refundETH function transfers ETH to the user before updating their balance to zero, introducing a reentrancy vulnerability. The external call to _to.transfer(refundValue) allows the recipient to re-enter the contract and call refund() again before their balance is reset. This can lead to an attacker repeatedly draining ETH from the contract. Additionally, the use of .transfer has a fixed gas limit, which could cause transactions to fail if more gas is required.

function _refundETH(address payable _to) internal {
uint256 refundValue = etherBalance[_to];
_to.transfer(refundValue);
etherBalance[_to] = 0;
}

Impact

  • Attackers can re-enter the contract and repeatedly call refund(), draining the ETH balance.

  • This can lead to complete depletion of ETH in the contract.

  • The vulnerability is severe and can cause significant financial loss if exploited.

Tools Used

Foundry

Recommendations

function _refundETH(address payable _to) internal {
uint256 refundValue = etherBalance[_to];
etherBalance[_to] = 0; // Update balance before external call
(bool success, ) = _to.call{value: refundValue}("");
require(success, "ETH Transfer Failed");
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

shrxyeh Submitter
11 months ago
0xtimefliez Lead Judge
11 months ago
shrxyeh Submitter
11 months ago
0xtimefliez Lead Judge
10 months ago
0xtimefliez Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

mutex lock incomplete

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.