Submitted by jayjonah8, also found by camden
In Vault.sol the sponsor() function does not have a reentrancy guard allowing an attacker to reenter the function because the depositors.mint() function has as callback to the msg.sender.  Since there are state updates after the call to depositors.mint() function this is especially dangerous.  An attacker can make it so the totalSponsored amount is only updated once after calling mint() several times since the update takes place after the callback.  The same will be true for the Sponsored event that is emitted.
https://github.com/code-423n4/2022-01-sandclock/blob/main/sandclock/contracts/Vault.sol#L244
A reentrancy guard modifier should be added to the sponsor() function in Vault.sol
naps62 (Sandclock) confirmed and resolved:
