search

DistributedCollective / oracle-based-amm

Other
12 stars 5 forks source link

Add V1 pool for SOV #20

Closed anon-xxs closed 3 years ago

eMarchenko commented 3 years ago

The last comment about reentrancy seems to be really important. Currently it is technically possible to reenter, and I'm not sure if one can exploit it. Possible scenario:

  1. Attacker initiates addLiquidity
  2. Attacker is called back and changes _liquidityPoolConverter.reserves (probably decreases it)
  3. as addLiquidity execution continues, it will get costReserveAmount as a smaller value and try to send extra tokens to the attacker.