Skip to content

Latest commit

 

History

History
24 lines (16 loc) · 1.62 KB

087.md

File metadata and controls

24 lines (16 loc) · 1.62 KB

dacian

medium

Follow Check-Effects-Interaction Pattern To Minimize Re-Entrancy Risks

Summary

Teller should follow the Checks-Effects-Interactions pattern to minimize risk of being hacked by re-entrancy attacks.

Vulnerability Detail

CollateralEscrowV1.withdraw() L95-L101 is the most obvious where amount is decremented after transferring the collateral; re-entry is possible if ERC721/1155 is transferred to an external contract. TellerV2._repayLoan() L746-L756 is another place where bid.loanDetails members are set after safeTransferFrom(). Neither of these appear to be exploitable, but Teller should implement the Checks-Effects-Interactions pattern to minimize risk.

Impact

Putting effects after interaction invites re-entrancy attacks.

Code Snippet

CollateralEscrowV1.withdraw() L95-L101 TellerV2._repayLoan() L746-L756

Tool used

Manual Review

Recommendation

Implement Checks-Effects-Interactions pattern throughout the codebase to minimize potential re-entrancy attacks