search

code-423n4 / 2021-06-tracer-findings

1 stars 0 forks source link

Add reentracy protections on function `executeTrade` #143

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

shw

Vulnerability details

Impact

As written in the to-do comments, reentrancy could happen in the executeTrade function of Trader since the makeOrder.market can be a user-controlled external contract.

Proof of Concept

Referenced code: Trader.sol#L121-L126

Recommended Mitigation Steps

Add a reentrancy guard (e.g., the implementation from OpenZeppelin) to prevent the users from reentering critical functions.

raymogg commented 3 years ago

Disputing just as while this is important, its quite explicitly stated in the todo comment and as such is already known by the team as a potential issue.

Realistically shouldn't be too much of a problem with whitelisting of the trader.

cemozerr commented 3 years ago

Marking this as medium risk as, regardless of being noted by the team, still poses a security threat.

OsmanBran commented 3 years ago

Duplicate of #72

loudoguno commented 3 years ago

removing duplicate label as per judge

loudoguno commented 3 years ago

changing risk from 1 to 2 as per judges sheet