Coburn Berry
Coburn Berry
@britto what do you think of this?
> Interesting vulnerability. `borrowFresh` is only called by `borrowInternal`, which has the `nonReentrant` modifier. So how was this possible? Was DeFiPie using a version of CToken.sol without that modifier? Please...
@llama There is one main subtlety I think you are missing: no individual cToken is ever reentered. cToken A calls into Token B which calls cTokenB which calls token C...
> Ahh of course, thanks @coburncoburn, that explains it. As you said, Compound has the protection of not allowing arbitrary coin listings. Additional assurance will be gained by moving `doTransferOut`...
https://twitter.com/CreamdotFinance/status/1432249771750686721 this flaw has been exploited in a second Compound fork
#153 has been started to address this issue