Submission Details
Severity:
Reentrancy in StabilityPool Withdrawals
Summary
Reentrancy in StabilityPool Withdrawals Attacler could re enter the function withdraw
Vulnerability Details
StabilityPool.withdraw() lacks reentrancy guards, risking fund drains if deToken implements ERC777 callbacks.
Impact
Attackers could re-enter the function to withdraw more funds than allowed.
Tools Used
Slither, MythX
Recommendations
Before: No reentrancy protection.
function withdraw(uint amount) external {
// Transfers deToken before updating state
}
After: Use
ReentrancyGuard.
function withdraw(uint amount) external nonReentrant {
// Update state before transfers
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.