Root + Impact

Description

• The distribute_dividends() function is intended to fairly distribute ETH profits among shareholders based on their current shareholding ratio, updating each shareholder’s balance after transfer.

• The function performs an external call to the shareholder’s address before updating their internal balance record, allowing a malicious contract to recursively re-enter the function and drain all ETH from the system.

Risk

Likelihood:

• The condition arises whenever a shareholder is a contract with a fallback or receive function that calls distribute_dividends() again during execution.

Dividend distribution occurs periodically, so a malicious shareholder can exploit this on every cycle.

Impact:

• Complete loss of ETH from the contract treasury.

Compromised trust and halted operation of the entire simulation ecosystem.

Proof of Concept

Deploy Attacker, register it as a shareholder, and trigger attack(target). The attacker repeatedly re-enters distribute_dividends() until all funds are drained.

Recommended Mitigation

•Use the checks-effects-interactions pattern: update internal state before any external calls.

• Alternatively, use a reentrancy guard with a locked boolean flag to prevent nested calls.

• Example fix: