# ERC20AssetPool and ERC721AssetPool should have the nonReentrant modifier as ERC721 and some tokens have callbacks Low/Info · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-L06 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description ERC721 implements a callback when transferring tokens. Some tokens, such as ERC777 implement callbacks when transferring. Both these tokens could lead to reentrancy. ### Recommendation Implement the nonReentrant modifier for ERC20AssetPool and ERC721AssetPool. ### Status Addressed in [#8b300f0](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/8b300f07a28f2c073154c8de3e9e90ba64ef1934). --- Related findings: - [xBundle(...) and xReceive(...) should have nonReentrant modifiers](https://0xsimao.com/findings/fuji-finance-bundle-non-reentrant-modifiers): Fuji Finance - [ETH withdrawals from EigenLayer always fail due to `OperatorDelegator`'s nonReentrant `receive()`](https://0xsimao.com/findings/renzo-eth-withdrawals-delegator-reentrant): Renzo - [Missing nonReentrant functionality in some execution paths](https://0xsimao.com/findings/yieldoor-iii-reentrant-functionality-execution-paths): Yieldoor LoopedVault Update - [Tokens with callbacks may allow malicious attackers to steal the protocol](https://0xsimao.com/findings/clip-finance-i-callbacks-malicious-attackers-steal): Clip Finance Strategies