Closed code423n4 closed 2 years ago
There is no PoC provided indicating an issue through reentrancy. State modification does not automatically make functions vulnerable to reentrancy.
For a medium severity issue, I would expect a more detailed explanation of the vulnerability.
The Cancel* orders are not calling any external contracts. So not sure if adding nonReentrant modifier to them makes sense.
Using nonReentrant on all functions that may change state is unnecessary. Without an indication on where this is required, the report is invalid.
Lines of code
https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L379 https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L390
Vulnerability details
Impact
Detailed description of the impact of this finding.
I noticed that the nonReentrant modifier only adds some of the functions that generate state changes to the InfinityExchange.sol contract, which provides the feasibility of reentrancy between multiple functions in a single contract, so I recommend adding the nonReentrant modifier to all functions that generate state changes.
Proof of Concept
Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.
Tools Used
Recommended Mitigation Steps
I recommend adding the nonReentrant modifier to all functions that generate state changes.