Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Transient Storage Slot Usage in `nonReentrant` Modifier

0xblackadam

Description

The nonReentrant modifier uses transient storage (tload and tstore) to prevent reentrancy attacks. However, it contains a critical flaw where different storage slots are used for checking and setting the reentrancy lock, leading to an ineffective protection mechanism.

Vulnerable Code

modifier nonReentrant() {
assembly {
if tload(1) { revert(0, 0) } // Checks slot 1
tstore(0, 1) // Stores lock in slot 0 (Incorrect)
}
_;
assembly {
tstore(0, 0) // Unlocks slot 0 (Incorrect)
}
}

Issues Identified

  1. Mismatch Between tload and tstore Slots

    • The modifier checks slot 1 (tload(1)) but sets and clears slot 0 (tstore(0, 1), tstore(0, 0)).

    • As a result, the lock is never properly checked, making the reentrancy guard ineffective.

  2. Potential Slot Collision

    • Using hardcoded slots (0 or 1) without ensuring their uniqueness may lead to unintended conflicts with other transient storage variables.

Impact

Reentrancy Protection Fails

  • Since the function checks one slot (1) but locks/unlocks another (0), reentrancy is not actually prevented.

  • A malicious attacker could re-enter all the function relying on this modifier without triggering the guard.

Recommendation

The corrected implementation should use a single storage slot for checking, locking, and unlocking.

Fixed Code

modifier nonReentrant() {
uint256 constant REENTRANCY_SLOT = 1; // Consistent slot usage
​
assembly {
if tload(REENTRANCY_SLOT) { revert(0, 0) } // Check the correct slot
tstore(REENTRANCY_SLOT, 1) // Lock
}
​
_; // Execute function
​
assembly {
tstore(REENTRANCY_SLOT, 0) // Unlock
}
}

Tools Used

  • Manual Code Review

  • Static Analysis

  • Foundry Tests

Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong value in nonReentrant modifier

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!