bug: move transfer only at the end to prevent reentrancy

pancakeswap · Mar 21, 2024 · 236a1d3 · 236a1d3
1 parent 919b164
commit 236a1d3
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 4 deletions.
diff --git a/.forge-snapshots/VaultTest#Vault.snap b/.forge-snapshots/VaultTest#Vault.snap
@@ -1 +1 @@
-7068
+7075
diff --git a/.forge-snapshots/VaultTest#testSettleAndRefund_WithErc20Transfer.snap b/.forge-snapshots/VaultTest#testSettleAndRefund_WithErc20Transfer.snap
@@ -1 +1 @@
-56136
+56176
diff --git a/.forge-snapshots/VaultTest#testSettleAndRefund_WithoutErc20Transfer.snap b/.forge-snapshots/VaultTest#testSettleAndRefund_WithoutErc20Transfer.snap
@@ -1 +1 @@
-36474
+36514
diff --git a/src/Vault.sol b/src/Vault.sol
@@ -140,11 +140,12 @@ contract Vault is IVault, VaultToken, Ownable {
             // msg.sender owes vault but paid more than than whats owed
             refund = paid - currentDelta.toUint256();
             paid = currentDelta.toUint256();
-            currency.transfer(to, refund);
         }
 
         reservesOfVault[currency] += paid;
         SettlementGuard.accountDelta(msg.sender, currency, -(paid.toInt128()));
+
+        if (refund > 0) currency.transfer(to, refund);
     }
 
     /// @inheritdoc IVault