Description
State changes should always be performed before interacting with an external contract, or it increases the risk of reentrancy attacks.
Recommendation
In Vault::withdraw() decrease allowances[token] before sending the funds. In Vault::withdrawFees() set totalFees to 0 before transferring the funds.
Status
Addressed in #2f47c6c.