Submitted by cmichel
The SettV3.transferFrom implements a _blockLocked call to prevent users to call several functions at once, for example, deposit and then transferring the tokens.
However, as the block lock only checks msg.sender, an attacker can circumvent it using transferFrom:
The protection desired from the _blockLocked call does not work for this function.
I assume the call is used to prevent flashloan attacks, but an attacker can bypass the protection on transferFrom.
The block lock should be on the account that holds the tokens, i.e., on sender (from address), not on msg.sender.
Parameterize _blockLocked to take an account parameter instead.
GalloDaSballo (BadgerDAO) acknowledged:
