Submission Details
Severity:
Reentrancy in Fee/Collateral Handling
Summary
ETH/WETH transfers during fee distribution or USDz swaps are vulnerable to reentrancy attacks.
Vulnerability Details
MarketMakingEngine uses raw call() for ETH transfers (e.g., sendWETHToLPs()) without reentrancy guards.
Impact
Malicious actors could re-enter the contract to drain WETH or manipulate collateral balances.
Tools Used
Slither (reentrancy detector), manual analysis.
Recommendations
Use ReentrancyGuard and follow checks-effects-interactions patterns. Replace call() with transfer() for ETH.
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821
USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.