Closed sherlock-admin2 closed 5 months ago
1 comment(s) were left on this issue during the judging contest.
panprog commented:
invalid, it's impossible to reenter these functions as there are no external calls
Invalid, lack required PoC by sherlock for reentrancy
w42d3n
medium
Reentrancies in oracle.sol
Summary
The contract oracle.sol does not protect against reentrancy attacks as it does not use the
nonReentrant
modifier on public and external functions that invoke other contract functions using an external call.Vulnerability Detail
In particular,
update
andrequest
functions call another contract function_updateCurrent
and_updateLatest
which can lead to potential reentrancy attacks if the referenced contract's functions are malicious.Impact
This vulnerability allows an attacker to drain a contract by repeatedly invoking the function before the initial function invocation has finished.
Code Snippet
https://github.com/sherlock-audit/2024-02-perennial-v2-3/blob/main/perennial-v2/packages/perennial-oracle/contracts/Oracle.sol#L30-L47
Tool used
Manual Review
Recommendation
To mitigate this issue, it is a good practice for Solidity developers to make all external function calls at the end of the function to minimize the malicious possibilities of external calls. Another important mitigation is to use a
nonReentrant
modifier on these functions, this modifier is usually provided by OpenZeppelin's ReentrancyGuard.