Part 2

Summary

The convertAccumulatedFeesToWeth function in the FeeDistributionBranch contract is vulnerable to a reentrancy attack due to external calls made before updating the contract's internal state: calls to swap strategies (executeSwapExactInputSingle or executeSwapExactInput).

This sequence allows an attacker to re-enter the function during the external call, potentially manipulating the receivedWethX18 value or other state variables before _handleWethRewardDistribution is executed.

Vulnerability Details

To clarify, the presence of the onlyRegisteredSystemKeepers modifier does not mitigate the reentrancy vulnerability. It ensures only authorized keepers can call the function, but it does not prevent reentrant calls.

An attacker initiates a call to convertAccumulatedFeesToWeth, during the external call to a swap strategy, the attacker re-enters the function and manipulates state variables.

Recommendations

Implement reentrancy guards to prevent re-entry into the function during external calls. Consider using the Checks-Effects-Interactions pattern to update the contract's state before making external calls.