M-07 MitigationConfirmed

[c4-bot-1]

Lines of code

Vulnerability details

The finding M-07: The traceEnd in BackingManager isn't updating correctly was fully mitigated, and the availability impact on Dutch auctions is no longer present.

As an additional suggestion, possibly with "low" severity, we would like to point out that the new implementation:

        delete tokensOut[sell];
        trade = super.settleTrade(sell); // nonReentrant

        TradeKind kind = trade.KIND();
        if (tradeEnd[kind] > block.timestamp) tradeEnd[kind] = uint48(block.timestamp);

does not follow the check-effect-interaction pattern. While we don't believe there is opportunity for a reentrancy exploit (because tradeEnd would prevent a dangerous call to rebalance in any case), we would recommend moving the tradeEnd update before the super.settleTrade call which contains interactions, like done for the delete tokensOut[sell] statement.

[c4-judge]

thereksfour marked the issue as satisfactory

[c4-judge]

thereksfour marked the issue as confirmed for report