Christmas Dinner

Summary

The nonReentrant modifier relies on a locked variable that is set to false after the function body executes.
If _refundETH or _refundERC20 interacts with malicious contracts, they can exploit this to re-enter the function.

Vulnerability Details

Impact

Attackers can repeatedly call refund and withdraw more funds than intended, leading to a complete loss of contract funds

Tools Used
manual review

Recommendations

Update the nonReentrant modifier to set locked = true before entering the function and reset it after execution. Alternatively, use OpenZeppelin’s ReentrancyGuard.

modifier nonReentrant() {
require(!locked, "No re-entrancy");
locked = true; // Lock before execution
_;
locked = false; // Unlock after execution
}