Submission Details
Severity:
Reentrancy in StabilityPool Withdrawals
Author Revealed upon completion
Summary
Reentrancy in StabilityPool Withdrawals Attacler could re enter the function withdraw
Vulnerability Details
StabilityPool.withdraw() lacks reentrancy guards, risking fund drains if deToken implements ERC777 callbacks.
Impact
Attackers could re-enter the function to withdraw more funds than allowed.
Tools Used
Slither, MythX
Recommendations
Before: No reentrancy protection.
function withdraw(uint amount) external {
// Transfers deToken before updating state
}
After: Use
ReentrancyGuard.
function withdraw(uint amount) external nonReentrant {
// Update state before transfers
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
View preliminary resultsAppeals Review
Appeals are being carefully reviewed by our judges.
Rewards Distribution
The contest is complete and the rewards are being distributed.