# The contract serves as a flashloan pool without fee

Reentrancy during fillOrder lets an attacker-controlled baseAsset contract exercise a short call and borrow PuttyV2's held assets fee-free, repaying at end of fillOrder.

- Payout: Contest reward
- Severity: medium
- Program: Putty
- Credited: 0xc0ffEE
- Disclosed: 2022-06-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-putty-findings/issues/377
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-putty%3AM-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:fee-bypass vuln:reentrancy

**Target:** PuttyV2 fillOrder/exercise option settlement
**Root cause:** fillOrder transfers premium to order.baseAsset before pulling the order's ERC20/NFT assets in, and lacks nonReentrant, so a malicious baseAsset contract can reenter exercise mid-fillOrder and drain held assets, repaying later.
**Steps:**
1. Deploy attacker contract acting as both maker and taker with a Long Call order whose baseAsset is the malicious contract.
2. Call `PuttyV2.fillOrder(order)`; during premium transfer to `order.baseAsset`, attacker code executes.
3. Reenter `PuttyV2.exercise(...)` on the short call position to trigger `_transferERC20sOut`/`_transferERC721sOut` and receive PuttyV2-held assets.
4. Use borrowed assets for profit on other platforms.
5. Return to fillOrder and repay via `_transferERC20sIn`/`_transferERC721sIn`, paying the 3% fee in the attacker's mintable fake token.
**How found:** Code-reading of fillOrder's ordering: premium is paid to baseAsset before order assets are pulled in, and exercise lacks a reentrancy guard, enabling mid-fillOrder reentry.
**Exploitation:** Attacker is both maker and taker; the fake baseAsset token is mintable so the 3% exercise fee is paid in worthless tokens. Assets already held by PuttyV2 are transferred out mid-fillOrder and repaid at the end, yielding a fee-free flashloan of all contract assets.
**Insight:** When a settlement function pays out to a caller-supplied token/asset before pulling collateral in, check whether that external call can reenter other value-moving functions (exercise/withdraw) that operate on already-held balances; fee tokens that are attacker-mintable nullify fee-based mitigations.