Root + Impact

Description

flashloan sets the flag true, calls the receiver, then sets it false. A receiver that re-enters flashloan for the same token: the inner loan completes and clears the flag; the outer loan's subsequent repay then reverts NotCurrentlyFlashLoaning, and the outer balance check fails → whole tx reverts. Composability footgun, and repay being callable by anyone while the flag is set means a third party can repay into someone else's loan (benign, but the accounting assumes msg.sender == initiator).

Risk

• A receiver that re-enters flashloan for the same token causes the inner loan to clear the flag, so the outer loan's repay reverts NotCurrentlyFlashLoaning and the whole transaction reverts.

• Likelihood: Low — requires a receiver that performs nested same-token flash loans.

• Impact: Low — composability footgun; repay being callable by anyone while the flag is set means a third party can repay into someone else's loan (benign, but the accounting assumes msg.sender == initiator).

Proof of Concept

No PoC test code — logic argument; see Vulnerability Details.

Recommended Mitigation

Scope the flag per-loan (e.g. store the active receiver/initiator), or document nested same-token loans as unsupported.