Summary

The claimNft() function in the TokenDivider contract is vulnerable to reentrancy attacks due to improper state management. The vulnerability comes from the use of safeTransferFrom(), which can trigger callback mechanisms in recipient contracts, allowing malicious actors to manipulate the contract's state before the transaction completes.

Vulnerability Details

The safeTransferFrom() function of the ERC721 standard allows external contracts to execute code via the onERC721Received() callback. If the recipient is a malicious contract, this callback can be used to recursively call the vulnerable claimNft() function. Since the state updates occur before the transfer, the attacker can exploit the function to claim multiple NFTs or drain the contract's NFT holdings.

Example Exploit Scenario

1. An attacker creates a malicious contract implementing onERC721Received().

2. The attacker calls claimNft() with a prepared NFT address.

3. During the execution of safeTransferFrom(), the onERC721Received() callback is triggered. Within the callback, the attacker recursively calls claimNft() while the internal state (e.g., balances and erc20ToMintedAmount) has already been reset.

4. The function's state has already been modified (balances zeroed), allowing multiple unauthorized NFT claims.

Impact

• Unauthorized multiple NFT withdrawals

• Potential complete drainage of contract's NFT holdings

• Manipulation of token burning and transfer mechanisms

• Significant financial risk to the protocol and its users

Recommendation

The function should be written this way