Submission Details
Severity:
Reentrancy Vulnerability in buyOrder() function
Relevant GitHub Links
Summary
The buyOrder function in TokenDivider contract contains a critical reentrancy vulnerability that allows an attacker to repeatedly purchase the same order before the state is updated.
Vulnerability Details
The vulnerability exists because the contract:
Performs erc20 transfer before updating state
Lacks reentrancy protection
Use low level call which can be exploited
function buyOrder(uint256 orderIndex, address seller) external payable {
// ... state checks ...
(bool success, ) = payable(order.seller).call{value: (order.price - sellerFee)}("");
// State changes occur after external call
s_userToSellOrders[seller][orderIndex] = s_userToSellOrders[seller][s_userToSellOrders[seller].length - 1];
s_userToSellOrders[seller].pop();
}
Impact
An attacker can:
Purchase same order multiple times
Drain contract funds
Get multiple ERC20 tokens for single payment
POC
contract ReentrancyTest is Test {
TokenDivider divider;
address attacker = makeAddr("attacker");
function testReentrancy() public {
vm.deal(attacker, 2 ether);
vm.startPrank(attacker);
// Setup order
// ... order creation code ...
// Attack
divider.buyOrder{value: 1.02 ether}(0, seller); // Price + fee
// Verify multiple purchases occurred
assertTrue(attackSucceeded);
}
}
contract AttackContract {
TokenDivider target;
bool attacked;
receive() external payable {
if(!attacked) {
attacked = true;
target.buyOrder{value: msg.value}(0, msg.sender);
}
}
}
Tools Used
Mannul Review
Recommendations
CEI
function buyOrder(uint256 orderIndex, address seller) external payable nonReentrant {
// ... checks ...
// Effects
s_userToSellOrders[seller][orderIndex] = s_userToSellOrders[seller][s_userToSellOrders[seller].length - 1];
s_userToSellOrders[seller].pop();
// Interactions
(bool success, ) = payable(order.seller).call{value: (order.price - sellerFee)}("");
}
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.