The current nonReentrant modifier is being used in BorrowController.sol, DepositController.sol, and OdosRepayAdapter.sol. However, the reentrant attack can occur when using payable(to).call{value: amount} or invoking functions with malicious ERC20 tokens.
Assuming the absence of malicious ERC20 tokens, the _burnAllSubstitute function, which contains the logic for payable(to).call{value: amount}, is safe from nonReentrant attacks as it always occurs as the final step.
I believe that unnecessary use of nonReentrant increases gas costs, so it is appropriate to remove it. Could vulnerabilities arise from removing the nonReentrant from the Controllers? @trust1995 @HickupHH3
Description
The current
nonReentrant
modifier is being used inBorrowController.sol
,DepositController.sol
, andOdosRepayAdapter.sol
. However, thereentrant
attack can occur when usingpayable(to).call{value: amount}
or invoking functions with malicious ERC20 tokens.Assuming the absence of malicious ERC20 tokens, the
_burnAllSubstitute
function, which contains the logic forpayable(to).call{value: amount}
, is safe fromnonReentrant
attacks as it always occurs as the final step.I believe that unnecessary use of
nonReentrant
increases gas costs, so it is appropriate to remove it. Could vulnerabilities arise from removing thenonReentrant
from the Controllers? @trust1995 @HickupHH3