046.md

Abundant Lace Mammoth

High

Reentrancy Vulnerability in claimFee Function Leads to Unauthorized Withdrawal of Funds .

Summary

The claimFee function is vulnerable to reentrancy attacks because it calls the market.claimFee(msg.sender) function before updating the internal state by calling market.token().push(comptroller). This allows an attacker to re-enter the claimFee function repeatedly potentially draining the contract funds.

Vulnerability Detail

The claimFee function is vulnerable to reentrancy attacks because it allows external calls to occur before updating its internal state making it possible for an attacker to repeatedly exploit the function and potentially drain the contract funds

Impact

Unauthorized withdrawal of funds : it allows attacker to steal money from the contract without any permission.

Code Snippet

https://github.com/sherlock-audit/2024-08-perennial-v2-update-3/blob/main/perennial-v2/packages/perennial-extensions/contracts/Coordinator.sol#L37-L40

Tool used

Manual Review

Recommendation

The recommendation is to move the market.token().push(comptroller) line above the market.claimFee(msg.sender) line. like this:

function claimFee(IMarket market) external { if (msg.sender != comptroller) revert NotComptroller(); market.token().push(comptroller); market.claimFee(msg.sender); }

or consider using Reentrancy Guard for protection