ak1 - Game.sol#L465 : `pushAllocationsToVaults` is harmed for reentrancy as state is update after the operation.

[sherlock-admin]

ak1

medium

Game.sol#L465 : pushAllocationsToVaults is harmed for reentrancy as state is update after the operation.

Summary

pushAllocationsToVaults - acts as Trigger to push delta allocations in protocols to cross chain vaults. pushes deltaAllocations to vaults.

The cross chain call is done based on below check,

require(isXChainRebalancing[_vaultNumber][_chain], "Vault is not rebalancing");

But the issue here is, the isXChainRebalancing[_vaultNumber][_chain] state is updated after the cross chain call.

Vulnerability Detail

Refer the summary section.

Impact

repeated allocation for vault which might end with accounting issue.

Code Snippet

https://github.com/sherlock-audit/2023-01-derby/blob/main/derby-yield-optimiser/contracts/Game.sol#L465-L477

Tool used

Manual Review

Recommendation

1. Add non-reentrant modifier.
2. update state of isXChainRebalancing[_vaultNumber][_chain] = false before calling the protocolAllocationsToArray and pushProtocolAllocationsToVault