Part 2

Summary

The convertMarketsCreditDepositsToUsdc function is vulnerable to reentrancy attacks due to external DEX interactions occurring before state updates.

Vulnerability Details

The convertMarketsCreditDepositsToUsdc function in the CreditDelegationBranch contract interacts with external DEX adapters to convert market credit deposits into USDC. This interaction occurs before the function updates the state with market.settleCreditDeposit. This sequence violates the Checks-Effects-Interactions pattern, a critical security practice designed to prevent reentrancy attacks. An attacker could exploit this by re-entering the function during the external call, potentially manipulating the state or repeatedly converting the same assets before the state is properly updated.

Impact

I'm rating this as LOW because the onlyRegisteredSystemKeepers is already in place, but the function doesn't fully address the possibility of a reentrant call. Reentrancy also depends on the security of the external DEX adapters and the ability of an attacker to craft a reentrant call. If the DEX adapters are secure and don't allow reentrant calls, the risk is reduced but not eliminated.

Tools Used

Recommendations

Adhere to the Checks-Effects-Interactions pattern. Update the market state before performing any external calls. Alternatively, apply a nonReentrant modifier to the function to block reentrant calls.