Part 2

Summary: Reentrancy in Vault.sol allows repeated withdrawals before balance updates, risking fund drainage.

Vulnerability Details:
The withdraw function in Vault.sol transfers assets before updating the user’s balance. ERC777 tokens with callbacks enable attackers to reenter the function, withdrawing more funds than their balance.

Code Reference:

Attack Scenario:
An attacker deposits ERC777 tokens, calls withdraw, and their contract reenters withdraw multiple times during the token’s tokensReceived callback. Each reentry withdraws the same amount, draining the vault.

Impact: High – Complete depletion of vault assets.

Recommendations:

1. Follow checks-effects-interactions: Update balances before transferring assets.

2. Use OpenZeppelin’s ReentrancyGuard modifier.