ethereum/go-ethereum

Top findings

• CriticalEXPLOIT: Re-entrancy risk — external call before state update, no guard

  beacon/light/sync/update_sync.go:149

  Verify the contract follows the Checks-Effects-Interactions pattern: (1) CHECK conditions first (require balance > 0), (2) UPDATE state (balance = 0), (3) INTERACT externally (call{value:}). Use OpenZeppelin ReentrancyGuard modifier on all functions making external calls. The nonReentrant modifier should appear on the function.

  Raw evidence

  id := requester.Send(server, ReqCheckpointData(s.checkpointHash))

• CriticalEXPLOIT: Re-entrancy risk — external call before state update, no guard

  beacon/light/sync/update_sync.go:153

  Verify the contract follows the Checks-Effects-Interactions pattern: (1) CHECK conditions first (require balance > 0), (2) UPDATE state (balance = 0), (3) INTERACT externally (call{value:}). Use OpenZeppelin ReentrancyGuard modifier on all functions making external calls. The nonReentrant modifier should appear on the function.

  Raw evidence

  requester.Send(server, ReqHeader(s.checkpointHash))

• CriticalEXPLOIT: Re-entrancy risk — external call before state update, no guard

  beacon/light/sync/update_sync.go:158

  Verify the contract follows the Checks-Effects-Interactions pattern: (1) CHECK conditions first (require balance > 0), (2) UPDATE state (balance = 0), (3) INTERACT externally (call{value:}). Use OpenZeppelin ReentrancyGuard modifier on all functions making external calls. The nonReentrant modifier should appear on the function.

  Raw evidence

  requester.Send(server, ReqHeader(s.parentHash))

• CriticalEXPLOIT: Re-entrancy risk — external call before state update, no guard

  accounts/manager.go:138

  Verify the contract follows the Checks-Effects-Interactions pattern: (1) CHECK conditions first (require balance > 0), (2) UPDATE state (balance = 0), (3) INTERACT externally (call{value:}). Use OpenZeppelin ReentrancyGuard modifier on all functions making external calls. The nonReentrant modifier should appear on the function.

  Raw evidence

  am.feed.Send(event)

• CriticalEXPLOIT: Re-entrancy risk — external call before state update, no guard

  accounts/keystore/keystore.go:171

  Verify the contract follows the Checks-Effects-Interactions pattern: (1) CHECK conditions first (require balance > 0), (2) UPDATE state (balance = 0), (3) INTERACT externally (call{value:}). Use OpenZeppelin ReentrancyGuard modifier on all functions making external calls. The nonReentrant modifier should appear on the function.

  Raw evidence

  ks.updateFeed.Send(event)

+ 55 more findings in the full report