Lines of code

Vulnerability details

Impact

Function claimRewards in ConcurRewardPool should be re-entrancy protected or first nullify the reward before sending it, otherwise, if any token contains a transfer callback hook, users can claim the same rewards multiple times, by re-entering the function upon the transfer and repeating the call.

Also, consider applying re-entrancy protection to functions that do not follow the Check-Effects-Interaction pattern, even though they are interating with tokens that are supposed to be safe.
For instance, functions deposit and withdraw in USDMPegRecovery first send the tokens and only then set the state.

Recommended Mitigation Steps

Solution: either apply nonReentrant modifier or substitute these lines in opposite order:

  IERC20(_tokens[i]).safeTransfer(msg.sender, getting);
  reward[msg.sender][_tokens[i]] = 0;  

The text was updated successfully, but these errors were encountered:

All reactions