Submission Details
Severity:
Reentrancy Risk in deposit on Treasury.so
Summary
Both the deposit and withdraw functions involve external calls (transferring tokens). Although the ReentrancyGuard modifier is used, it's important to ensure state updates are made before external calls to prevent reentrancy.
Vulnerability Details
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
Impact
A malicious actor could exploit the reentrancy vulnerability by calling back into the deposit or withdraw function before the state updates are completed, leading to multiple deposits.
Tools Used
Recommendations
Update the state before making external calls (token transfers) to ensure the contract cannot be exploited through reentrancy.
_balances[token] += amount;
_totalValue += amount;
IERC20(token).transferFrom(msg.sender, address(this), amount);
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.