Reentrancy Vulnerability in claimCollateralRebates() Function in KeeperProxy.sol
Summary
The claimCollateralRebates() function in the KeeperProxy contract does not implement reentrancy protection, making it vulnerable to reentrancy attacks. An attacker can exploit this by recursively calling the function before the contract updates the balance, allowing them to drain more collateral rebates than they are entitled to.
Vulnerability Details
• The function claimCollateralRebates() interacts with IPerpetualVault.claimCollateralRebates(timeKeys).
• If the PerpetualVault contract makes an external call before updating internal balances, an attacker could re-enter and repeatedly withdraw more funds than they should.
• No nonReentrant modifier is used, allowing reentrant calls
Impact
• Loss of funds: Attackers can drain the protocol’s vaults by recursively calling claimCollateralRebates().
• Disruption of services: The vault could be left with insufficient collateral for legitimate users.
• Potential cascading failures: If the vault interacts with other DeFi protocols, it could trigger systemic risks.
Tools Used
• Manual Code Review
• Slither (Static Analysis)
Recommendations
Apply the nonReentrant modifier from OpenZeppelin to claimCollateralRebates():
Lead Judging Commences
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Suppositions
There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Suppositions
There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.