Core Contracts

Summary

The FeeCollector.sol contract lacks a reentrancy guard on distributeCollectedFees(), which allows reentrant callsto manipulate fee distribution.

Vulnerability Details

• The function distributeCollectedFees() transfers fees before deleting stored values:

  delete collectedFees;

• If an attacker reenters via a callback function before delete collectedFees executes, they can double-claim fees.

• This allows multiple fee withdrawals in a single transaction.

PoC

Missing nonReentrant modifier in distributeCollectedFees() in FeeCollector.sol.

Exploit Scenario

• The attacker reenters the fee distribution function before delete collectedFees executes.

• This allows multiple withdrawals in a single transaction.

• Funds are drained due to multiple withdrawals.

PoC Exploit

Expected Outcome

• The attacker drains the FeeCollector’s balance.

• The function distributes more fees than intended.

• Legitimate users lose rewards due to reentrancy.

Impact

• Fee theft: Attackers can withdraw more than their fair share of collected fees.

• Incorrect accounting: Fee balances may not reflect reality, impacting governance decisions.

Tools Used

• Slither for reentrancy detection

• Foundry Tests simulating reentrant calls

• Manual code Review

Recommendations

• Add the nonReentrant modifier to distributeCollectedFees():

  function distributeCollectedFees() external nonReentrant whenNotPaused { ... }

• Ensure fee updates occur before external calls using the Checks-Effects-Interactions pattern.

• Implement unit tests for reentrancy scenarios.