Vyper Vested Claims
First Flight #34
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Reentrancy Issue in claim Function

GMJ

Summary

Reentrancy Risk in claim Function

Vulnerability Details

This function is vulnerable because it performs an external call (extcall IERC20(self.token).transfer(user, claimable)) after updating the state (self.claimed_amount[user] += claimable). This violates the Checks-Effects-Interactions (CEI) pattern, which is a best practice for preventing reentrancy attacks.

def claim(user: address, total_amount: uint256, proof: DynArray[bytes32, 20]) -> bool:
"""
@notice This function is used to claim the tokens
@dev Anyone can claim for any user
@param user address, the address of the user
@param total_amount uint256, the total amount of tokens
@param proof DynArray[bytes32, 20], the merkle proof
@return bool True if the claim is successful
"""
# Checks
assert self.verify_proof(user, total_amount, proof), "Invalid proof"
assert block.timestamp >= self.vesting_start_time, "Claiming is not available yet"
​
claimable: uint256 = 0
current_amount: uint256 = self.claimed_amount[user]
vested: uint256 = self._calculate_vested_amount(total_amount)
​
# Calculate how much the user can claim now
if vested > current_amount:
claimable = vested - current_amount
​
assert claimable > 0, "Nothing to claim"
# Update the claimed amount - Effects
self.claimed_amount[user] += claimable
# invariant: claimed amount should always be less than or equal to amount (better safe then sorry)
assert current_amount + claimable <= total_amount, "Claimed amount exceeds total amount"
log Claimed(user, claimable)
# Transfer the claimable amount to the user - Interactions
_success: bool = extcall IERC20(self.token).transfer(user, claimable)
assert _success, "Transfer failed"
return True

Impact

The most immediate and severe impact is the potential draining of funds from the contract. An attacker could exploit the reentrancy vulnerability to repeatedly claim tokens before the state is updated, allowing them to withdraw more tokens than they are entitled to.

Tools Used

Manual analysis

Recommendations

To fix this reentrancy vulnerability, you need to follow the Checks-Effects-Interactions (CEI) pattern. This means:

Perform all checks (e.g., proof verification, timestamp validation).
​
Update the state (e.g., increment claimed_amount).
​
Perform external calls (e.g., transfer tokens).
Updates

Appeal created

bube Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.