Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Reentrancy Vulnerability in PerpetualVault.sol

luffy

Summary

The PerpetualVault.sol contract is susceptible to reentrancy attacks during deposit and withdrawal operations. Although the contract uses ReentrancyGuard, there are potential gaps in its implementation, especially when interacting with external protocols like GMX or Paraswap.

Vulnerability Details

The deposit and withdraw functions in PerpetualVault.sol interact with external contracts (e.g., GMX, Paraswap) without ensuring that reentrancy is fully mitigated. For example, if a malicious contract is used as a token or if an external call fails, it could lead to reentrancy

function deposit(uint256 amount) external nonReentrant {
require(amount >= minDepositAmount, "Deposit too small");
IERC20(usdc).transferFrom(msg.sender, address(this), amount);
_updateDeposit(msg.sender, amount);
emit Deposit(msg.sender, amount);
}

Impact

An attacker could exploit this vulnerability to drain funds from the vault by repeatedly calling the deposit or withdraw function before the state is updated.

Tools Used

  • Slither (static analysis tool)

  • Manual code review

Recommendations

Add a nonReentrant modifier to all functions that interact with external contracts and ensure that state changes occur before external calls

function deposit(uint256 amount) external nonReentrant {
require(amount >= minDepositAmount, "Deposit too small");
_updateDeposit(msg.sender, amount); // State change before external call
IERC20(usdc).transferFrom(msg.sender, address(this), amount);
emit Deposit(msg.sender, amount);
}
Updates

Lead Judging Commences

n0kto Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

n0kto Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.