Submission Details
Impact:
Likelihood:
Missing Reentrancy Protection inside the `liquidity_pool.rs`
Description: The contract lacks explicit reentrancy protection. While Solana's account model provides some inherent protection against reentrancy, complex cross-program invocation (CPI) scenarios could still be vulnerable, especially in the liquidity provision and swap functions.
Impact: A malicious contract could potentially reenter the AMM functions during token transfers, manipulating pool state and stealing funds.
Recommended Mitigation: Implement a reentrancy guard pattern:
pub struct LiquidityPool {
pub token_a: Pubkey,
pub token_b: Pubkey,
pub lp_mint: Pubkey,
pub bump: u8,
pub entered: bool, // Add reentrancy guard flag
}
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.