Submission Details
Severity:
Reentrancy in WToken Redemption
Summary
Lack of reentrancy guards during WToken unwrapping allows recursive attacks.
Vulnerability Details
When users call redeemWToken, the contract burns WTokens, withdraws aTokens from Aave, and transfers collateral. An attacker could re-enter the function during the transfer step to drain funds.
Impact
Loss of user collateral due to reentrant withdrawals.
Tools Used
Slither reentrancy detector, manual analysis.
Recommendations
Use OpenZeppelin’s ReentrancyGuard on redeemWToken
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
51929 USDC / LOC
14,000
1,000
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.