# Checks effects interactions pattern is now always followed Low/Info · Three Sigma · Cross-chain bridge · 15th July, 2024 Finding 3S-OB-N01 of the Orange Bridge security review. - Protocol: https://www.orangeweb3.com/ - Report: /reports/orange - Source: https://cdn.sanity.io/files/qoqld077/production/686ad4e1d5035d69002f5f97e281e3c5a8b7ce00.pdf --- ### Description State changes should always be performed before interacting with an external contract, or it increases the risk of reentrancy attacks. ### Recommendation In Vault::withdraw() decrease allowances[token] before sending the funds. In Vault::withdrawFees() set totalFees to 0 before transferring the funds. ### Status Addressed in [#2f47c6c](https://github.com/orangecryptohq/orange-bridge-contract/commit/2f47c6cd85cb445b70f5e57fba6d8b955d082d0a). --- Related findings: - [Checks effects interactions pattern is not always followed](https://0xsimao.com/findings/singularity-effects-interactions-pattern-followed): Singularity - [Checks effects interactions pattern should always be used](https://0xsimao.com/findings/glacier-checks-effects-interactions-pattern): Glacier - [completeUnstake() not following checks-effects-interactions pattern](https://0xsimao.com/findings/metazero-ii-complete-unstake-following-interactions): MetaZero Staking - [Checks-effects-interations pattern is not always followed, which can be used to drain all tokens](https://0xsimao.com/findings/singularity-effects-interations-followed-drain): Singularity