# Missing nonReentrant functionality in some execution paths Low/Info · 0xSimao · Leveraged yield farming · 23rd June 2025 Finding L-1 of the Yieldoor LoopedVault Update security review. - Protocol: https://app.yieldoor.com/ - Report: /reports/yieldoor-iii - Source: https://github.com/0xSimao/audits/blob/main/0xSimao/2025-06-23-yieldoor-iii.pdf --- **Description:** `LoopedVault::rebalance()` is [missing](https://github.com/spacegliderrrr/loopedVault/blob/master/src/LoopedVaultV1_1.sol#L306) the nonReentrant modifier. `LoopedVault::requestWithdraw()` [flow](https://github.com/spacegliderrrr/loopedVault/blob/master/src/LoopedVaultV1_1.sol#L517) when there are not enough idle funds also never checks for reentrancy. It only does when withdrawing as it calls `LoopedVault::_withdraw(`), which does have the modifier. `LoopedVault::fulfillWithdraw()` is [missing](https://github.com/spacegliderrrr/loopedVault/blob/master/src/LoopedVaultV1_1.sol#L536) the `nonReentrant` modifier. **Recommended Mitigation:** Add the `nonReentrant` modifier to `LoopedVault::requestWithdraw()` and remove it from `LoopedVault::_withdraw()`. **0xSimao:** Fixed in [#2a378db](https://github.com/spacegliderrrr/loopedVault/commit/2a378db6c6356887fd029685cc947e4eaa2270b3). --- Related findings: - [xBundle(...) and xReceive(...) should have nonReentrant modifiers](https://0xsimao.com/findings/fuji-finance-bundle-non-reentrant-modifiers): Fuji Finance - [ETH withdrawals from EigenLayer always fail due to `OperatorDelegator`'s nonReentrant `receive()`](https://0xsimao.com/findings/renzo-eth-withdrawals-delegator-reentrant): Renzo - [ERC20AssetPool and ERC721AssetPool should have the nonReentrant modifier as ERC721 and some tokens have callbacks](https://0xsimao.com/findings/singularity-erc20-erc721-reentrant-callbacks): Singularity