Summary

The current implementation of the nonReentrant modifier does not properly prevent reentrancy by setting the locked state variable at the right place in the modifier.

Vulnerability Details

• The locked state variable is only set to false at the end of the modifier, which can potentially allow reentrancy during the execution of the function.

• It is important to set locked = true at the start of the modifier to prevent reentrancy attacks from triggering during the function execution.

Impact

• A reentrancy attack could happen.

Tools Used

• Manual code review.

Recommendations

Update the nonReentrant modifier to ensure that locked is set to true at the start of the function. This prevents reentrancy attacks more effectively. The corrected modifier should look as follows: