折返攻击

Question

我需要一些帮助，这段代码容易受到重入攻击吗？

function withdraw(address to, uint256 amountOfEth) external override onlyOwner {
    require(_balances[to].shares >= amountOfEth, "Burn exceeds balance");

    (uint256 amortizedLiability, uint256 withdrawAmount) = _getWithdrawAmount(to, amountOfEth);

    _balances[to].eth = _balances[to].eth.sub(amountOfEth);
    _balances[to].liability = _balances[to].liability.sub(amortizedLiability);
    _eth = _eth.sub(amountOfEth);
    _totalLiability = _totalLiability.sub(amortizedLiability);

    if (withdrawAmount > 0) {
        IERC20(_token).safeTransfer(to, withdrawAmount);
        emit FeeWithdrawn(_token, to, withdrawAmount, amountOfEth);
    }
}

Answer 1

由于您在IERC20(_token).safeTransfer之前更改了合同状态，所以我认为它看起来非常安全。

我很高兴_getWithdrawAmount不做任何外部调用。