Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Missing reentrancy guard #762

Closed
zajck opened this issue Aug 9, 2023 · 1 comment · Fixed by #765
Closed

Missing reentrancy guard #762

zajck opened this issue Aug 9, 2023 · 1 comment · Fixed by #765
Assignees
@zajck
Labels
bug Something isn't working v2.3.0

Comments

@zajck
Copy link
Member

zajck commented Aug 9, 2023

setAllowlistedFunctions is missing the reentrancy guard, which under certain circumstances allows the attacker to impersonate the admin account and modify the allow list.

boson-protocol-contracts/contracts/protocol/facets/MetaTransactionsHandlerFacet.sol

Lines 339 to 342 in 9070c04

function setAllowlistedFunctions(
bytes32[] calldata _functionNameHashes,
bool _isAllowlisted
) public override onlyRole(ADMIN) {

Recommendation

Add the reentrancy guard.
@zajck zajck added the bug Something isn't working label Aug 9, 2023
@zajck zajck self-assigned this Aug 10, 2023
@zajck zajck added the v2.3.0 label Aug 10, 2023
@zajck zajck mentioned this issue Aug 10, 2023
Merged
@mischat
Copy link
Member

mischat commented Aug 28, 2023

Good catch here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@zajck zajck

Labels
bug Something isn't working v2.3.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add the missing reentrancy guard bosonprotocol/boson-protocol-contracts
2 participants
@mischat @zajck