Submission Details
Severity:
Wrong logic in InheritanceManager::nonReentrant modifier allows an attacker to drain the contract
Summary
The InheritanceManager::nonReentrant modifier uses transient storage for reentrancy locks but the logic is wrong. The modifier reads from slot 1 while saving to slot 0. This means the lock check and the lock setting are operating on different storage slots.
Impact
An attacker might drain the contract. Even though it seems not to be possible with the functions using the nonReentrant modifier because of the presence of onlyOwner modifier, it's better to correct this error.
Tools Used
Manual Review
Recommendations
Read and save to the same slot. Do this in the modifier:
modifier nonReentrant() {
assembly {
- if tload(1) { revert(0, 0) }
+ if tload(0) { revert(0, 0) }
tstore(0, 1)
}
_;
assembly {
tstore(0, 0)
}
}
Updates
Lead Judging Commences
0xtimefliez 6 months ago
Submission Judgement Published Assigned finding tags:
Wrong value in nonReentrant modifier
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.