Reentrancy in withdraw function

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-concur/blob/main/contracts/Shelter.sol#L52-L59

Vulnerability details

Description

The contract was found vulnerable to Reentrancy attack. It was noticed that the function withdraw makes an external call to another untrusted address or a contract before it resolves any effects at line https://github.com/code-423n4/2022-02-concur/blob/main/contracts/Shelter.sol#L57

If the attacker controls the untrusted contract, they may be able to call back to the original function, repeating interactions that would have otherwise not run after the effects were resolved.

Impact

Reentrancy vulnerabilities can lead to various critical outcomes such as token stealing and burning. Adversaries may exploit the bug to mint tokens without any limitations or extract all the tokens out of the contract.

• This vulnerability may lead to withdrawal token more than once.

PoC

Check the withdraw function and we will notice it is missing nonReentrant modifier.
https://github.com/code-423n4/2022-02-concur/blob/main/contracts/Shelter.sol#L52-L59

Recommended Mitigation Steps

Introduce a modifier nonreentrant to prevent Reentrancy vulnerabilities by implementing a Check-Effects-Interactions pattern.

[r2moon]

duplicated with #260

[GalloDaSballo]

Duplicate of #260
But written as a low quality copy-paste