Submitted by 0xImpostor
When the current owner of the card is still the new owner of the card, transferCard is called before the treasury is updated. While this does not currently pose a risk, it is not aligned with best practices of check-effect-interations and opens your code to a potential re-entrancy attack in the future.
Splidge (Reality Cards) commented:
