Basket.sol should use the Upgradeable variant of OpenZeppelin Contracts

[code423n4]

Handle

WatchPug

Vulnerability details

As per the OpenZeppelin docs:

If your contract is going to be deployed with upgradeability, such as using the OpenZeppelin Upgrades Plugins, you will need to use the Upgradeable variant of OpenZeppelin Contracts.

https://github.com/code-423n4/2021-10-defiprotocol/blob/7ca848f2779e2e64ed0b4756c02f0137ecd73e50/contracts/contracts/Basket.sol#L7-L7

import { ReentrancyGuard } from "@openzeppelin/contracts/security/ReentrancyGuard.sol";

Recommendation

Change to:

import { ReentrancyGuardUpgradeable } from "@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol";

[GalloDaSballo]

While I believe there's no security risk, this is a valid finding and I'd recommend the sponsor to mitigate as recommended