Assessment reports>WOOFi Swap>Discussion>Function `skimMulTokens` does not work

Function skimMulTokens does not work

In WooPPV2, the onlyAdmin function skim transfers to the owner any balance above the reserve of the token, which includes fees and tokens erroneously sent to the contract:

function skim(address token) public nonReentrant onlyAdmin {
    TransferHelper.safeTransfer(token, owner(), balance(token) - tokenInfos[token].reserve);
}

It also has a function skimMulTokens that calls this for multiple tokens:

function skimMulTokens(address[] memory tokens) external nonReentrant onlyAdmin {
    unchecked {
        uint256 len = tokens.length;
        for (uint256 i = 0; i < len; i++) {
            skim(tokens[i]);
        }
    }
}

However, the nonReentrant modifier is on both of these functions, which means that skimMulTokens will always revert due to the reentrancy guard.

This issue has been acknowledged by WOOFI, and a fix was implemented in commit c19894f9.

Zellic © 2024Back to top ↑