{"action":"created","issue":{"url":"https://api.github.com/repos/MakerDAO/token-auction/issues/16","repository_url":"https://api.github.com/repos/MakerDAO/token-auction","labels_url":"https://api.github.com/repos/MakerDAO/token-auction/issues/16/labels{/name}","comments_url":"https://api.github.com/repos/MakerDAO/token-auction/issues/16/comments","events_url":"https://api.github.com/repos/MakerDAO/token-auction/issues/16/events","html_url":"https://github.com/MakerDAO/token-auction/issues/16","id":162496075,"number":16,"title":"Eliminate re-entrant bugs","user":{"login":"rainbeam","id":18486361,"avatar_url":"https://avatars.githubusercontent.com/u/18486361?v=3","gravatar_id":"","url":"https://api.github.com/users/rainbeam","html_url":"https://github.com/rainbeam","followers_url":"https://api.github.com/users/rainbeam/followers","following_url":"https://api.github.com/users/rainbeam/following{/other_user}","gists_url":"https://api.github.com/users/rainbeam/gists{/gist_id}","starred_url":"https://api.github.com/users/rainbeam/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rainbeam/subscriptions","organizations_url":"https://api.github.com/users/rainbeam/orgs","repos_url":"https://api.github.com/users/rainbeam/repos","events_url":"https://api.github.com/users/rainbeam/events{/privacy}","received_events_url":"https://api.github.com/users/rainbeam/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-06-27T16:41:38Z","updated_at":"2016-06-27T18:02:38Z","closed_at":null,"body":"The auction manager is possibly vulnerable to a maliciously crafted selling / buying token that re-enters `bid` or `claim` within its own `transfer` or `transferFrom` method.\r\n\r\nI don't know of an exploit, but haven't audited to see if one exists.\r\n\r\nPossible means of eliminating re-entrant attacks:\r\n\r\n1. Move all calls to external contracts to the end of the `bid` / `claim` calls, after state has been modified.\r\n\r\n2. Use a mutex modifier on all public functions."},"comment":{"url":"https://api.github.com/repos/MakerDAO/token-auction/issues/comments/228825383","html_url":"https://github.com/MakerDAO/token-auction/issues/16#issuecomment-228825383","issue_url":"https://api.github.com/repos/MakerDAO/token-auction/issues/16","id":228825383,"user":{"login":"rainbeam","id":18486361,"avatar_url":"https://avatars.githubusercontent.com/u/18486361?v=3","gravatar_id":"","url":"https://api.github.com/users/rainbeam","html_url":"https://github.com/rainbeam","followers_url":"https://api.github.com/users/rainbeam/followers","following_url":"https://api.github.com/users/rainbeam/following{/other_user}","gists_url":"https://api.github.com/users/rainbeam/gists{/gist_id}","starred_url":"https://api.github.com/users/rainbeam/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rainbeam/subscriptions","organizations_url":"https://api.github.com/users/rainbeam/orgs","repos_url":"https://api.github.com/users/rainbeam/repos","events_url":"https://api.github.com/users/rainbeam/events{/privacy}","received_events_url":"https://api.github.com/users/rainbeam/received_events","type":"User","site_admin":false},"created_at":"2016-06-27T18:02:38Z","updated_at":"2016-06-27T18:02:38Z","body":"Whilst I'm thinking about it - perhaps it would be good to keep a registry of known non malicious tokens (of which collateral tokens are a subset). Then the manager can optionally link to and check against that."}}
{"actor":{"display_login":"rainbeam"}}