ERC677 callAfterTransfer() Reentrancy

Description

The ERC677 token's callAfterTransfer() function is vulnerable to reentrancy attacks. This occurs when the transfer function calls an external contract, which then calls back into the token contract, allowing an attacker to drain the contract's funds.

Examples

Insecure Code

function transfer(address to, uint256 value) public {
    balances[msg.sender] -= value;
    callAfterTransfer();
    balances[to] += value;
}

Secure Code

function transfer(address to, uint256 value) public {
    balances[msg.sender] -= value;
    balances[to] += value;
    callAfterTransfer();
}

Remediation

Use the Checks-Effects-Interactions pattern to prevent reentrancy. This involves checking conditions, making any necessary changes to the contract's state, and then making external calls.

Rule Details

Field	Value
ID	CODE-0231
Category	Crypto
Severity	HIGH
CWE	CWE-841
Confidence	HIGH
Impact	HIGH
Likelihood	MEDIUM
Exploitability	MODERATE
Tags	reentrancy, erc677
OWASP	N/A

References

• https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611
• https://twitter.com/peckshield/status/1509431646818234369
• https://twitter.com/blocksecteam/status/1509466576848064512
• https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58

---