H-01 MitigationConfirmed

[code423n4]

Lines of code

Vulnerability details

Original Issue

code-423n4/2023-06-angle-findings#24

Details

This issue shows attackers can charge more collaterals during the redemption/swap using the reentrancy attack.

Mitigation

PR: AngleProtocol/angle-transmuter@864c1c4

It mitigated the issue by adding a reentrancy guard to _redeem() and _swap().

    modifier nonReentrant() {
        TransmuterStorage storage ts = s.transmuterStorage();
        // Reentrant protection
        // On the first call, `ts.statusReentrant` will be `NOT_ENTERED`
        if (ts.statusReentrant == ENTERED) revert ReentrantCall();
        // Any calls to the `nonReentrant` modifier after this point will fail
        ts.statusReentrant = ENTERED;

        _;

        // By storing the original value once again, a refund is triggered (see https://eips.ethereum.org/EIPS/eip-2200)
        ts.statusReentrant = NOT_ENTERED;
    }

    function _redeem(
        uint256 amount,
        address to,
        uint256 deadline,
        uint256[] memory minAmountOuts,
        address[] memory forfeitTokens
    ) internal nonReentrant returns (address[] memory tokens, uint256[] memory amounts) {}

    function _swap(
        uint256 amountIn,
        uint256 amountOut,
        address tokenIn,
        address tokenOut,
        address to,
        bool mint,
        Collateral storage collatInfo,
        bytes memory permitData
    ) internal nonReentrant {}        

Conclusion

It was mitigated properly.

[c4-judge]

hansfriese marked the issue as satisfactory

[c4-judge]

hansfriese marked the issue as confirmed for report