Missing nonReentrant functionality in some execution paths

Low/InfoYieldoor LoopedVault Update audit·by 0xSimao·Leveraged yield farming·23rd June 2025L-1

Description:

LoopedVault::rebalance() is missing the nonReentrant modifier. LoopedVault::requestWithdraw() flow when there are not enough idle funds also never checks for reentrancy. It only does when withdrawing as it calls LoopedVault::_withdraw(), which does have the modifier. LoopedVault::fulfillWithdraw() is missing the nonReentrant modifier.

Recommended Mitigation:

Add the nonReentrant modifier to LoopedVault::requestWithdraw() and remove it from LoopedVault::_withdraw().

0xSimao:

Fixed in #2a378db.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests