Skip to content
Request an audit

‹ All findings

ConnextHandler executeFailedWithUpdatedArgs(...) reentrancy allowedCaller can steal all ConnextHandler tokens

Crit/HighFuji Finance·Three Sigma · Lending aggregator · 6th May, 20233S-FUJI-H04

ReportSource

Description

In executeFailedWithUpdatedArgs(...), the allowedCaller can steal all assets available on the ConnextHandler by calling executeFailedWithUpdatedArgs(...) again after the xBundle(...) call. This can be mitigated also by adding the nonReentrant modifier to xBundle(...).

Recommendation

Write txn.executed = true; before the try/catch call and rewrite txn.executed = false if it fails.

Status

Addressed here: Fujicracy/fuji-v2#621