Reentrancy attacks that could lead to significant fund losses.
Summary
Although the contract uses ReentrancyGuard, certain functions (e.g., afterOrderExecution, refundExecutionFee) interact with external contracts and transfer funds, which could introduce reentrancy risks if not handled carefully.
Vulnerability Details
function afterOrderExecution(
bytes32 requestKey,
Order.Props memory order,
EventLogData memory eventData
) external override validCallback(requestKey, order) {
bytes32 positionKey = keccak256(
abi.encode(
address(this),
order.addresses.market,
order.addresses.initialCollateralToken,
order.flags.isLong
)
-
Proof of Concept (PoC):
An attacker exploits a reentrancy vulnerability during the
afterOrderExecutioncallback, draining funds from the contract.
Impact
High. Reentrancy attacks could lead to significant fund losses.
Tools Used
Recommendations
Use the
checks-effects-interactionspattern consistently in all functions that interact with external contracts.Conduct thorough testing of all external contract interactions.
Perform regular security audits to identify and fix potential vulnerabilities.
Lead Judging Commences
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Suppositions
There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Suppositions
There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.