Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Reentrancy Vulnerability in CreditDelegationBranch Contract

cheatc0d33

Summary

A reentrancy vulnerability exists in the CreditDelegationBranch contract where malicious tokens could reenter during approval calls, potentially leading to multiple unauthorized swaps.

During asset conversion operations, the contract performs token approvals followed by DEX swaps:

IERC20(asset).approve(dexSwapStrategy.dexAdapter, assetAmount);
usdcOut = dexSwapStrategy.executeSwapExactInputSingle(swapCallData);

The external call to the token's approve function creates a reentrancy window where a malicious token contract could reenter the CreditDelegationBranch before the swap execution completes.

Impact

A malicious token could exploit this vulnerability by reentering during the approval process, which would allow it to execute multiple swaps using the same approval while manipulating the contract's state between the initial approval and swap execution.

Proof of Concept

contract MaliciousToken {
function approve(address spender, uint256 amount) public returns (bool) {
// Reenter CreditDelegationBranch here
CreditDelegationBranch(msg.sender)._convertAssetsToUsdc(...);
return true;
}
}

Recommended Fix

import {ReentrancyGuard} from "@openzeppelin/security/ReentrancyGuard.sol";
​
contract CreditDelegationBranch is EngineAccessControl, ReentrancyGuard {
function _convertAssetsToUsdc(
uint128 dexSwapStrategyId,
address asset,
uint256 assetAmount,
bytes memory path,
address recipient,
address usdc
)
internal
nonReentrant
returns (uint256 usdcOut)
{
IERC20(asset).approve(dexSwapStrategy.dexAdapter, assetAmount);
usdcOut = dexSwapStrategy.executeSwapExactInputSingle(swapCallData);
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.