Christmas Dinner

Summary

Reentrancy flaw in the refund() function.

Vulnerability Details

-The refund() function uses the nonReentrant() modifier, but it's incorrectly implemented as the locked variable is set as false, failing to prevent reentrant calls.
-Due to this inaccurate implementation, the contract is vulnerable to potential reentrancy attacks.

Impact

-Critical security flaw that could allow an attacker to drain funds from the contract.
-Large financial losses could occur.

Tools Used

Static code analysis, Automated audit tools

Recommendations

Correct the implementation of nonReentrant() modifier ensuring that locked variable is set to true before the function call.
Adopt proper mitigation techniques against reentrancy attacks.