Submitted by kenzo, also found by WatchPug, GimelSec, Czar102, and AuditsAreUS
https://github.com/code-423n4/2022-04-abranft/blob/main/contracts/NFTPair.sol#L218
https://github.com/code-423n4/2022-04-abranft/blob/main/contracts/NFTPairWithOracle.sol#L238
_requestLoan makes an external call to the collateral contract before updating the NFTPair contract state.
If the ERC721 collateral has a afterTokenTransfer hook,
The NFTPair contract can be reentered, and a loan can be requested without the borrower supplying the collateral.
Someone can then lend for the loan while the collateral is missing from the contract.
Therefore the malicious borrower received the loan without supplying collateral - so lenders funds can be stolen.
The issue is present in both NFTPair and NFTPairWithOracle.
Assume the NFT contract has an afterTokenTransfer hook which calls back to the malicious borrower.
POC in short: borrower will call requestLoan with skim==false, then during the hook will reenter requestLoan with skim==true, then call removeCollateral to get his collateral back, then the first requestLoan will resume and initiate the loan, although the collateral is not in the contract any more.
POC in long: the borrower will do the following:
Move the external call to the end of the function to conform with checks-effects-interaction pattern.
cryptolyndon (AbraNFT) disputed and commented:
0xean (judge) downgraded to medium severity and commented:
For this contest, 45 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by IllIllI received the top score from the judge.
The following wardens also submitted reports: horsefacts, bobi, berndartmueller, reassor, joestakey, hyh, MaratCerby, defsec, pauliax, z3s, simon135, CertoraInc, delfin454000, 0xf15ers, BowTiedWardens, kenzo, Funen, antonttc, bobirichman, sikorico, samruna, catchup, oyc_109, m9800, gzeon, ilan, GimelSec, AuditsAreUS, broccolirob, cccz, kenta, unforgiven, robee, 0x1337, gs8nrv, jah, 0x1f8b, hubble, kebabsec, WatchPug, throttle, mics, Ruhum, and 0xDjango.
