Lines of code

Vulnerability details

Impact

The fallback function delegates calls to the implementation contract using delegatecall. This allows the implementation contract to call back into MErc20Delegate before the original delegatecall completes. An attacker could exploit this vulnerability to perform reentrant calls, potentially leading to malicious actions, such as stealing funds or manipulating contract state.

function fallback() external payable {
implementation.delegatecall(msg.data);
}
An attacker could repeatedly trigger the fallback function while it is still executing, causing unexpected behavior and allowing the attacker to perform unauthorized actions within the contract.

Proof of Concept

The attacker could deploy a malicious implementation contract that includes reentrant calls to the MErc20Delegate contract’s functions during the fallback execution.

contract MaliciousImplementation {
function reentrantCall() external payable {
MErc20Delegate.fallback();
MErc20Delegate.withdraw(msg.value);
}
}

Tools Used

manual code review were used.

Recommended Mitigation Steps

Consider using the nonReentrant modifier or a reentrancy guard in the fallback function to prevent reentrant calls.
Ensure that any external contract calls are made after internal state updates to minimize the impact of reentrancy.

Assessed type

Reentrancy

The text was updated successfully, but these errors were encountered:

All reactions