Summary

A critical race condition vulnerability exists in the _cancelFlow function due to improper handling of the global counter variable. This allows cancellation operations to reference incorrect deposit records when multiple users interact with the contract concurrently, leading to misdirected fund transfers and permanent loss of user assets.

Vulnerability Details

Technical Background

The cancellation logic uses the current counter value to identify deposits:

Key Flaw:
The counter variable increments on new deposits regardless of cancellation state, creating temporal coupling between unrelated operations.

Attack Scenario (POC)

1. Initial State

   • User A deposits: counter = 5

   • depositInfo[5] contains A's 10 ETH

2. Cancellation Initiation

   • Admin begins cancelling A's deposit (still processing)

3. Race Condition Trigger

   • User B deposits: counter increments to 6

   • depositInfo[6] contains B's 20 ETH

Result:

• User B receives refund of THEIR 20 ETH (depositId=6)

• User A's 10 ETH remains locked (depositId=5 never processed)

• User B gains double funds (original 20 ETH + cancellation refund)

• Protocol loses 20 ETH

Impact

Fund loss

Tools Used

manual review