matter-labs / zksync

zkSync: trustless scaling and privacy engine for Ethereum
https://zksync.io
Apache License 2.0
4.88k stars 2.68k forks source link

Lack of Reentrancy Protection #572

Open maaaaani opened 7 months ago

maaaaani commented 7 months ago

The contract includes a receive function that accepts Ether, but it does not include any logic to prevent reentrancy attacks. Consider adding appropriate checks and using the "Checks-EffectsInteractions" pattern to mitigate reentrancy vulnerabilities. following route is: core/tests/ts-integration/contracts/paymaster-nonce/Paymaster.sol