Linda Yaccarino Profile picture
CEO @X • Leading the X mission to be the everything app for everyone. Everything good begins with belief. 🇺🇸
Nov 22, 2021 11 tweets 5 min read
🧵 Schrödinger's Sheep: How to claim 300x the amount of $WOOL when unstaking your sheep in @WolfDotGame turning 20,000 $WOOL into 6,000,000 $WOOL

Technical deep dive below on how it works 👇 (1/10) The claim and unstake branch of the code has a form of reentrancy vulnerability: it calls safeTansferFrom to send your sheep BEFORE deleting its staking information.

The problem here is that safeTransferFrom calls into the address receiving the token if it is a contract.