Submitted by leastwood
There are a number of functions in RCTreasury.sol which make external calls to another contract before updating the underlying market balances. More specifically, these affected functions are deposit(), sponsor(), and topupMarketBalance(). As a result, these functions would be prone to reentrancy exploits. However, as safeTransferFrom() operates on a trusted ERC20 token (RealityCards token), this issue is of low severity. See issue page for reference code.
Recommend modifying the aforementioned functions such that all state changes are made before a call to the ERC20 token using the safeTransferFrom() function.
Splidge (Reality Cards) confirmed and patched:
