Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

make MiniMeToken inherit ReentrancyGuard #26

Closed
wants to merge 2 commits into from

Commits on Sep 19, 2023

  1. chore: add missing trailing slash in remapping

    This was not causing any compilation issues, but the solidity language
    server gets confused by this and complains about incorrect import
    statements otherwise.
    0x-r4bbit committed Sep 19, 2023
    Configuration menu
    Copy the full SHA
    e5a30d0 View commit details
    Browse the repository at this point in the history

Commits on Sep 20, 2023

  1. security: make MiniMeToken inherit ReentrancyGuard

    If a `MiniMeToken` has a `TokenController` configured, it can intercept
    every transfer using the `onTransfer` callback and reenter the
    `MiniMeToken` contract.
    
    This is a reentrancy vulnerablity as a malicious `TokenController` has
    access to the `MiniMeToken` `balances` and it privileged to perform
    transfers.
    
    Unfortunately, simply using the CEI-pattern as done in
    #24 isn't sufficient, because the
    reentrancy can be done non-recursively, resulting in no error and a
    possible double spent issue.
    
    To prevent this vulnerablity, this commit introduces OZ's
    `ReentrancyGuard` and makes `MiniMeToken` inherit it. This gives us
    access to the `nonReentrant` modifer that is attached to every transfer
    function.
    
    The commit also introduces a test that proves that the contract reverts
    in case of a reentrancy attempt.
    
    Closes: #17
    0x-r4bbit committed Sep 20, 2023
    Configuration menu
    Copy the full SHA
    7008c98 View commit details
    Browse the repository at this point in the history