search

code-423n4 / 2021-10-pooltogether-findings

0 stars 0 forks source link

No need to put ReentrnacyGaurd on PrizePool.constructor. #10

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

pants

Vulnerability details

No need to put ReentrnacyGaurd on PrizePool.constructor.

PierrickGT commented 3 years ago

We call ReentrancyGuard to call the constructor from the Open Zeppelin contract module.

This is indeed not needed since the condition _status != _ENTERED will still be true despite _status not being set to _NOT_ENTERED, _status will be by default false and the condition will still be true.

That being said, calling the constructor is a best practice and it is preferable to call it to avoid any surprise if the Open Zeppelin team did decide to update the logic in the constructor. We could bump the Open Zeppelin package and have no way to know if the modifier would still work or no.

We acknowledge this minor issue but we won't actually change anything for the reasons provided above.

GalloDaSballo commented 3 years ago

Sponsor acknwlodges and gives a valid explanation as to why they will not mitigate, fundamentally no harm in either options