Permissions - notSameBlock is insufficient for reentrancy protection

[code423n4]

Handle

ScopeLift

Vulnerability details

Impact

TBD how bad the impact is

The docs mention that the notSameBlock modifier (and associated _notSameBlock() method) is used to guard against reentrancy. However, users can still call a method twice in a single transaction by using transferring assets/positions between two accounts they control, and re-entering with the other account

Proof of Concept

N/A

Tools Used

Recommended Mitigation Steps

Change notSameBlock to a standard reentrancy guard such as this one from Solmate

abstract contract ReentrancyGuard {
    uint256 private reentrancyStatus = 1;

    modifier nonReentrant() {
        require(reentrancyStatus == 1, "REENTRANCY");
        reentrancyStatus = 2;
        _;
        reentrancyStatus = 1;
    }
}

[0xScotch]

#195

[GalloDaSballo]

Duplicate of #195

[GalloDaSballo]

This is a duplicate submission by the same warden, making as invalid