Egis-Security / CTF_Challenge

Repository containing CTF challenges from nmirchev8, deth and bOgO.
14 stars 8 forks source link

reentrancy attack in withdraw function in deth contract #2

Closed YavorJJ closed 3 months ago

YavorJJ commented 3 months ago

using low level call will result in a reentrancy

`solidity function withdraw(uint256 amount) external { require(!locked, "Vault is locked"); require(balances[msg.sender] >= amount, "Insufficient balance"); balances[msg.sender] -= amount; @> (bool success, ) = payable(msg.sender).call{value: amount}(""); require(success); emit Withdrawn(msg.sender, amount); }

`

Consider using a reentrancy guard to prevent reentrant calls. This can be done by adding a non-reentrant modifier.

@> contract Vault is ReentrancyGuard @> import "@openzeppelin/contracts/security/ReentrancyGuard.sol";