Platform: Code4rena
Start Date: 22/09/2023
Pot Size: $100,000 USDC
Total HM: 15
Participants: 175
Period: 14 days
Judge: alcueca
Total Solo HM: 4
Id: 287
League: ETH
Rank: 150/175
Findings: 1
Award: $11.47
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: MrPotatoMagic
Also found by: 0xAadi, 0xDING99YA, 0xDemon, 0xRstStn, 0xSmartContract, 0xStriker, 0xWaitress, 0xbrett8571, 0xfuje, 0xsagetony, 0xsurena, 33BYTEZZZ, 3docSec, 7ashraf, ABA, ABAIKUNANBAEV, Aamir, Audinarey, Bauchibred, Black_Box_DD, Daniel526, DanielArmstrong, DanielTan_MetaTrust, Dinesh11G, Eurovickk, Franklin, Inspecktor, John, Jorgect, Joshuajee, K42, Kek, Koolex, LokiThe5th, MIQUINHO, Myd, NoTechBG, QiuhaoLi, SanketKogekar, Sathish9098, Sentry, Soul22, SovaSlava, Stormreckson, Tendency, Topmark, Udsen, V1235816, Viktor_Cortess, Viraz, Yanchuan, ZdravkoHr, Zims, albahaca, albertwh1te, alexweb3, alexxander, ast3ros, audityourcontracts, bareli, bin2chen, bronze_pickaxe, c0pp3rscr3w3r, cartlex_, castle_chain, chaduke, debo, ether_sky, gumgumzum, imare, its_basu, jaraxxus, jasonxiale, josephdara, kodyvim, ladboy233, lanrebayode77, lsaudit, mert_eren, minhtrng, n1punp, nadin, niroh, nmirchev8, orion, peakbolt, perseverancesuccess, pfapostol, ptsanev, rvierdiiev, saneryee, shaflow2, te_aut, terrancrypt, twcctop, unsafesol, ustas, versiyonbir, windhustler, yongskiws, zhaojie, ziyou-
11.4657 USDC - $11.47
In several internal functions in the BranchBridgeAgent and RootBridgeAgent contracts, there is a contract structure that is not in accordance with best practice Check-Effect-Interactions where after making an external call there is a state update, this could be a gap for reentrancy in this function.
There are four instances of this issue :
File : src/BranchBridgeAgent.sol 831 Deposit storage deposit = getDeposit[_depositNonce]; 832 deposit.owner = _refundee; 833 834 addressArray[0] = _hToken; 835 deposit.hTokens = addressArray; 836 837 addressArray[0] = _token; 838 deposit.tokens = addressArray; 839 840 uintArray[0] = _amount; 841 deposit.amounts = uintArray; 842 843 uintArray[0] = _deposit; 844 deposit.deposits = uintArray; 845 846 deposit.status = STATUS_SUCCESS; 881 Deposit storage deposit = getDeposit[_depositNonce]; 882 deposit.owner = _refundee; 883 deposit.hTokens = _hTokens; 884 deposit.tokens = _tokens; 885 deposit.amounts = _amounts; 886 deposit.deposits = _deposits; 887 deposit.status = STATUS_SUCCESS;
File : src/RootBridgeAgent.sol 1014 settlement.owner = _refundee; 1015 settlement.recipient = _recipient; 1016 1017 addressArray[0] = localAddress; 1018 settlement.hTokens = addressArray; 1019 1020 addressArray[0] = underlyingAddress; 1021 settlement.tokens = addressArray; 1022 1023 uintArray[0] = _amount; 1024 settlement.amounts = uintArray; 1025 1026 uintArray[0] = _deposit; 1027 settlement.deposits = uintArray; 1028 1029 settlement.dstChainId = _dstChainId; 1030 settlement.status = STATUS_SUCCESS; 1106 settlement.owner = _refundee; 1107 settlement.recipient = _recipient; 1108 settlement.hTokens = hTokens; 1109 settlement.tokens = tokens; 1110 settlement.amounts = _amounts; 1111 settlement.deposits = _deposits; 1112 settlement.dstChainId = _dstChainId; 1113 settlement.status = STATUS_SUCCESS;
GitHub : 1014 - 1030, 1106 - 1113
#0 - c4-pre-sort
2023-10-15T13:04:18Z
0xA5DF marked the issue as sufficient quality report
#1 - c4-judge
2023-10-21T12:38:32Z
alcueca marked the issue as grade-b