JBProjects.sol#createFor(...) function is open to reentrancy attacks

Lines of code Vulnerability details JBProjects.solcreateFor... which used in JPController.sollaunchProjectFor... can be used for reentrancy. PoC contracts/JBProjects.sol: 131: function createForaddress owner, JBProjectMetadata calldatametadata 132 external 133 override 134 returns uint256 project...

JBProjects.createFor should be able to set the project controller

Lines of code Vulnerability details Impact JBProjects.createFor doesn’t set the project controller. Project owners need to call JBDirectory.setControllerOf to set the project controller. However, an allowedlisted address can set the controller before the actual project owner. We can assume that...