Use reentrancy guards in deposit and withdraw functions
While our examination of the contracts did not reveal any instances of reentrancy scenarios, we strongly advise the implementation of reentrancy guards as a precautionary measure. The following functions lack protection against reentrancy:
ZapFrom: The
swapAndBridge
,permitSwapAndBridge
functions.ZapDest: The
withdraw
function.StrategyVault: The
deposit
,withdraw
,claimEmissions
andwithdrawFromQueue
function.
This recommendation is based on the potential for certain tokens to incorporate callbacks during transfers, which can introduce vulnerabilities if not adequately safeguarded against.
The issue was fixed in commit 46d5cba↗.