OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

No ReentrancyGuard

amro135ali

Root + Impact

Description

  • Normal behavior:

The contract updates state before making external calls, which is good practice and prevents most reentrancy attacks. However, the contract does not use OpenZeppelin's ReentrancyGuard, which is a standard and widely adopted protection against reentrancy.

  • Issue:

If the contract is extended in the future, or if a non-standard token is used, reentrancy could become a risk. Without ReentrancyGuard, a future developer may inadvertently introduce a vulnerability.

function buyOrder(uint256 _orderId) public {
Order storage order = orders[_orderId];
// ... state updated before external calls
iUSDC.safeTransferFrom(msg.sender, address(this), protocolFee);
iUSDC.safeTransferFrom(msg.sender, order.seller, sellerReceives);
IERC20(order.tokenToSell).safeTransfer(msg.sender, order.amountToSell); // @> External call
totalFees += protocolFee;
emit OrderFilled(_orderId, msg.sender, order.seller);
}

Risk

Likelihood:

  • Low in current implementation, but may increase with future changes or non-standard tokens.

Impact:

  • Potential for reentrancy attacks, leading to loss of funds.

Proof of Concept

// This PoC shows that while the current code is safe, future changes could introduce reentrancy risks.
// Suppose a new function is added that makes an external call before updating state.
// Without ReentrancyGuard, this could be exploited by a malicious contract.

Recommended Mitigation

: Add OpenZeppelin's ReentrancyGuard and nonReentrant modifier to all state-changing functions.
Explanation: Using a reentrancy guard is a best practice that protects the protocol from both current and future reentrancy vulnerabilities, even if the current code is safe.
Updates

Lead Judging Commences

yeahchibyke Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!