Skip to content

fix: ensure reentrancy guard is cleared on all exit paths in stake#586

Merged
Xhristin3 merged 1 commit into
Gatheraa:mainfrom
Kabi3si:fix/issue-512-reentrancy-guard
Jun 28, 2026
Merged

fix: ensure reentrancy guard is cleared on all exit paths in stake#586
Xhristin3 merged 1 commit into
Gatheraa:mainfrom
Kabi3si:fix/issue-512-reentrancy-guard

Conversation

@Kabi3si

@Kabi3si Kabi3si commented Jun 27, 2026

Copy link
Copy Markdown
Contributor

Summary

stake set REENTRANCY_GUARD but did not clear it on every early-exit path (particularly inside handle_cross_chain_stake which could panic after the guard was set). A stuck guard would permanently block future calls. Additionally, update_reward had no initialisation-check guard.

Changes

  • contract/contracts/src/cross_chain.rs: refactor stake to use a clear closure that removes the guard before every panic! / early return. Move chain-validity checks into stake before delegating to handle_cross_chain_stake, so panics in validation clear the guard first.
  • contract/contracts/src/storage.rs: add an early-return guard in update_reward when the contract is not yet initialised, preventing a spurious panic that would bypass the caller-side guard cleanup.

Testing

  • A simulated token-callback re-entry into stake returns "reentrant call detected" without leaving the guard set.
  • Normal stake flow clears the guard after committing user state.

Closes #512

@Xhristin3 Xhristin3 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Xhristin3 Xhristin3 merged commit 378b920 into Gatheraa:main Jun 28, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[contract][security] update_reward missing reentrancy guard

2 participants