OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

No ReentrancyGuard

Author Revealed upon completion

Root + Impact

Description

  • Normal behavior:

The contract updates state before making external calls, which is good practice and prevents most reentrancy attacks. However, the contract does not use OpenZeppelin's ReentrancyGuard, which is a standard and widely adopted protection against reentrancy.

  • Issue:

If the contract is extended in the future, or if a non-standard token is used, reentrancy could become a risk. Without ReentrancyGuard, a future developer may inadvertently introduce a vulnerability.

function buyOrder(uint256 _orderId) public {
Order storage order = orders[_orderId];
// ... state updated before external calls
iUSDC.safeTransferFrom(msg.sender, address(this), protocolFee);
iUSDC.safeTransferFrom(msg.sender, order.seller, sellerReceives);
IERC20(order.tokenToSell).safeTransfer(msg.sender, order.amountToSell); // @> External call
totalFees += protocolFee;
emit OrderFilled(_orderId, msg.sender, order.seller);
}

Risk

Likelihood:

  • Low in current implementation, but may increase with future changes or non-standard tokens.

Impact:

  • Potential for reentrancy attacks, leading to loss of funds.

Proof of Concept

// This PoC shows that while the current code is safe, future changes could introduce reentrancy risks.
// Suppose a new function is added that makes an external call before updating state.
// Without ReentrancyGuard, this could be exploited by a malicious contract.

Recommended Mitigation

: Add OpenZeppelin's ReentrancyGuard and nonReentrant modifier to all state-changing functions.
Explanation: Using a reentrancy guard is a best practice that protects the protocol from both current and future reentrancy vulnerabilities, even if the current code is safe.
Updates

Lead Judging Commences

yeahchibyke Lead Judge about 5 hours ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.