DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Potential Front-Running Attack on executeTransaction()

equation

Summary

Front-running risk

Vulnerability Details

function executeTransaction(uint256 txId) external onlyOwners {
Transaction storage txn = transactions[txId];

if (!txn.approvedByOwner1 || !txn.approvedByOwner2) revert NotEnoughApprovals();
if (txn.executed) revert();
​
txn.executed = true;
​
(bool success, ) = txn.to.call{value: txn.value}("");
require(success, "Transaction failed");
​
emit TransactionExecuted(txId, txn.to, txn.value);

}

Impact

If executeTransaction() is called with a transaction targeting an external contract, a front-runner could monitor mempool transactions and attempt to modify the state of the receiving contract before execution

Tools Used

Recommendations

Implement time-lock delays or a queue system.

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.