Summary:
The deposit function in ZlpVault.sol updates user balances after transferring tokens, opening a reentrancy attack vector.

Vulnerability Details:
In ZlpVault.sol, the deposit function transfers user tokens before updating the user's balance. A malicious ERC20 token with a callback mechanism (e.g., ERC777) could reenter the function, allowing the attacker to manipulate balances and mint extra ZLP tokens.

Code Reference:

• ZlpVault.sol (Lines 30-40):

  function deposit(uint256 amount) external {

  IERC20(token).transferFrom(msg.sender, address(this), amount); // External call before state change

  balances[msg.sender] += amount; // State update after external call

  mintZlpTokens(msg.sender, amount);

  }

Impact:
Attackers can drain the vault by reentering the deposit function multiple times before balances are updated, minting excessive ZLP tokens and withdrawing more assets than deposited.

Recommendations:
Follow the Checks-Effects-Interactions pattern: update balances before interacting with external contracts. Alternatively, use a reentrancy guard modifier.