Skip to content

Conversation

@avniculae
Copy link
Contributor

@avniculae avniculae commented Dec 18, 2025

  • Reentrancy attacks should not be a concern for the Spoke since Hub, IR Strategy and Price Feeds are trusted, and V4 does not support ERC20s with callbacks.
  • That said, adding (transient) reentrancy locks is a low-cost, effective protection.

@avniculae avniculae force-pushed the feat/reentrancy-locks branch from 0dcc11b to d4f9ba8 Compare December 18, 2025 17:31
import {MockERC1271Wallet} from 'tests/mocks/MockERC1271Wallet.sol';
import {MockSpokeInstance} from 'tests/mocks/MockSpokeInstance.sol';
import {MockSkimSpoke} from 'tests/mocks/MockSkimSpoke.sol';
import {MockReentrantHub} from 'tests/mocks/MockReentrantHub.sol';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

more contracts into base :'(

@avniculae avniculae changed the title feat: Reentrancy locks feat: Reentrancy locks in Spoke Dec 19, 2025
@avniculae avniculae marked this pull request as ready for review December 19, 2025 11:11
@avniculae avniculae force-pushed the feat/reentrancy-locks branch from d4f9ba8 to 875b77c Compare December 19, 2025 11:18
uint256 collateralReserveId = _daiReserveId(spoke);
uint256 debtReserveId = _wethReserveId(spoke);

// _updateTargetHealthFactor(spoke, 1.001e18);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rm?

);
vm.expectRevert(ReentrancyGuardTransient.ReentrancyGuardReentrantCall.selector);
vm.prank(bob);
spoke1.supply(_daiReserveId(spoke1), amount, bob);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's use onBehalf so we make sure reentrancy lock is checked first.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants