DEFED

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. ### External call(s) ```solidity=116 IERC20(token).transfer(to,amount); ``` ### State variables written after the call(s) ```solidity=117 transactions[transactionId] = true; ``` --- ### External call(s) ```solidity=124 IWETH(WETH).withdraw(amount); ``` ```solidity=125 _safeTransferETH(to, amount); ``` * This function call executes the following external call(s). * In `AssetManagement._safeTransferETH`, * `(success) = to.call{value: value}(new bytes(0))` ### State variables written after the call(s) ```solidity=126 transactions[transactionId] = true; ```

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. ### External call(s) ```solidity=70 _mintNFT(msg.sender); ``` * This function call executes the following external call(s). * In `AssetManagement._mintNFT`, * `IERC721(BANKCARDNFT).mint(to)` ### State variables written after the call(s) ```solidity=71 deposited[msg.sender] = true; ``` --- ### External call(s) ```solidity=84 _mintNFT(msg.sender); ``` * This function call executes the following external call(s). * In `AssetManagement._mintNFT`, * `IERC721(BANKCARDNFT).mint(to)` ### State variables written after the call(s) ```solidity=85 deposited[msg.sender] = true; ``` --- ### External call(s) ```solidity=95 _mintNFT(msg.sender); ``` * This function call executes the following external call(s). * In `AssetManagement._mintNFT`, * `IERC721(BANKCARDNFT).mint(to)` ### State variables written after the call(s) ```solidity=96 deposited[msg.sender] = true; ``` --- ### External call(s) ```solidity=105 _mintNFT(msg.sender); ``` * This function call executes the following external call(s). * In `AssetManagement._mintNFT`, * `IERC721(BANKCARDNFT).mint(to)` ### State variables written after the call(s) ```solidity=106 deposited[msg.sender] = true; ``` --- ### External call(s) ```solidity=39 IUserProxy(proxy).initialize(owner, DOMAIN_SEPARATOR); ``` ### State variables written after the call(s) ```solidity=40 getProxy[owner] = proxy; ``` --- ### External call(s) ```solidity=76 IFlashSwapCallee(to).flashSwapCall(msg.sender, balance0, data); ``` ### State variables written after the call(s) ```solidity=78 _burn(address(this), balance1); ``` * This function call executes the following assignment(s). * In `VToken._burn`, * `_balances[account] = _balances[account] - amount` ```solidity=78 _burn(address(this), balance1); ``` * This function call executes the following assignment(s). * In `VToken._burn`, * `_totalSupply = _totalSupply - amount` --- ### External call(s) ```solidity=27 VToken(vToken).initialize( token, PToken, tokenName, tokenSymbol, tokenDecimals ); ``` ### State variables written after the call(s) ```solidity=34 getVToken[token] = vToken; ```

The function `flashSwap()` interacts with the contract that implements the `IFlashSwapCallee` interface. We treat the 3rd party protocol as a black box and assume its function correctly. It does not need the caller's `vToken` but directly mint tokens to perform the swap. We would like to confirm with the client if the current implementation aligns with the original project design.

The function `_transfer()` lacks the check that whether the balance of sender can cover the transfer amount to get a more exact error message.

The function `transferFrom()` lacks the check for `_allowances[sender][_msgSender] >= amount`.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=59 WETH = _weth; ``` - `_weth` is not zero-checked before being used. --- ```solidity=60 BANKCARDNFT = _bankCardNFT; ``` - `_bankCardNFT` is not zero-checked before being used. --- ```solidity=45 proxyFactory = _proxyFactory; ``` - `_proxyFactory` is not zero-checked before being used. --- ```solidity=46 vTokenFactory = _vTokenFactory; ``` - `_vTokenFactory` is not zero-checked before being used. --- ```solidity=47 lendingPool = _lendingPool; ``` - `_lendingPool` is not zero-checked before being used. --- ```solidity=48 bridgeFeeController = _bridgeFeeController; ``` - `_bridgeFeeController` is not zero-checked before being used. --- ```solidity=52 virtualDefedToken = _virtualDefedToken; ``` - `_virtualDefedToken` is not zero-checked before being used. --- ```solidity=53 veDEFE = _veDEFE; ``` - `_veDEFE` is not zero-checked before being used. --- ```solidity=41 ETHToken = token; ``` - `token` is not zero-checked before being used. --- ```solidity=42 PToken = _PToken; ``` - `_PToken` is not zero-checked before being used. --- ```solidity=43 bridgeControl = _bridgeControl; ``` - `_bridgeControl` is not zero-checked before being used.

The return value of the transfer()/transferFrom() call is not checked. ```solidity=74 IERC20(token).transferFrom(msg.sender,address(this),amount); ``` --- ```solidity=88 IERC20(token).transferFrom(msg.sender,address(this),amount); ``` --- ```solidity=116 IERC20(token).transfer(to,amount); ``` --- ```solidity=67 IERC20(vToken).transfer(bridgeFeeVault,fee); ``` --- ```solidity=64 IERC20(vToken).transfer(networkFeeVault,fee); ``` --- ```solidity=81 IERC20(vToken).transfer(networkFeeVault,fee); ``` --- ```solidity=84 IERC20(vToken).transfer(params.bridgeControl,targetAmount); ``` --- ```solidity=98 IERC20(vToken).transfer(networkFeeVault,fee); ``` --- ```solidity=122 IERC20(aToken).transfer(proxyAddr,targetAmount); ``` --- ```solidity=138 IERC20(vToken).transfer(networkFeeVault,fee); ``` --- ```solidity=157 IERC20(vToken).transfer(networkFeeVault,fee); ``` --- ```solidity=179 IERC20(vToken).transfer(networkFeeVault,fee); ``` --- ```solidity=182 IERC20(vToken).transfer(params.bridgeControl,targetAmount); ``` --- ```solidity=196 IERC20(vToken).transfer(networkFeeVault,fee); ```