Core Contracts

Summary

The collectFee function calls external contracts (such as transferring tokens) and performs state updates afterward. Although the nonReentrant modifier is applied, there's still a potential reentrancy vulnerability because the state update is done after the external call.

Vulnerability Details

Impact

This can allow a malicious contract to call back into the collectFee function before the state update, leading to multiple fee collections, potentially draining the contract’s balance.

Tools Used

Recommendations

Always update the state before making external calls to prevent reentrancy attacks. This can be fixed by updating the fee tracking state before transferring the tokens.