code-423n4 / 2021-10-defiprotocol-findings

0 stars 0 forks source link

createBasket re-entrancy #85

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

pauliax

Vulnerability details

Impact

function createBasket in Factory should also be nonReentrant as it interacts with various tokens inside the loop and these tokens may contain callback hooks.

Recommended Mitigation Steps

Add nonReentrant modifier to the declaration of createBasket.

GalloDaSballo commented 2 years ago

I agree that since the function can potentially interact with any ERC20like token, the function is vulnerable to re-entrancy, because we don't have any specific POC for an attack, this is a medium severity finding