Summary

ETH/WETH transfers during fee distribution or USDz swaps are vulnerable to reentrancy attacks.

Vulnerability Details

MarketMakingEngine uses raw call() for ETH transfers (e.g., sendWETHToLPs()) without reentrancy guards.

Impact

Malicious actors could re-enter the contract to drain WETH or manipulate collateral balances.

Tools Used

Slither (reentrancy detector), manual analysis.

Recommendations

Use ReentrancyGuard and follow checks-effects-interactions patterns. Replace call() with transfer() for ETH.