# Reentrancy bug allows lender to steal other lenders funds

LineOfCredit._close sends tokens to lender before deleting credit state, letting an ERC777 lender reenter close() and drain other lenders' deposits.

- Payout: Contest reward
- Severity: medium
- Program: Debt DAO
- Credited: 0xdeadbeef0x
- Disclosed: 2023-02-07
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-debtdao-findings/issues/160
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:reentrancy

**Target:** LineOfCredit.sol _close() credit module
**Root cause:** _close() calls LineLib.sendOutTokenOrETH to the lender before `delete credits[id]`, so a token with transfer hooks (ERC777/ERC223) can reenter close() while the credit entry still exists.
**Steps:**
1. Deploy ERC777-style token whose transfer invokes tokensReceived on recipient.
2. Lender contract registers as recipient and implements tokensReceived to call `line.close(id)` guarded by a lock flag.
3. Borrower adds credit from lender1 (1000 tokens), borrows, repays.
4. Borrower adds second credit from lender2 (1000 tokens).
5. Borrower calls `line.close(id_first)`; sendOutTokenOrETH triggers lender1.tokensReceived which reenters `line.close(id_first)` before `delete credits[id]`, paying out deposit+interestRepaid again.
6. Assert lender1 balance == 2000 (own 1000 + lender2's 1000).
**How found:** Code review of _close() noting state deletion (`delete credits[id]`) occurs after external token transfer, combined with knowledge that oracle-listed tokens may include ERC777/ERC223 with transfer callbacks.
**Exploitation:** Lender supplies a hook-bearing ERC777 token supported by the oracle; on close, the payout transfer reenters close() repeatedly (bounded by LineOfCredit balance) to withdraw the same credit.deposit+interestRepaid multiple times, siphoning other lenders' funds of the same token.
**Insight:** In credit/lending modules, check ordering of external token transfers vs. state deletion in close/withdraw paths; any oracle-whitelisted token with transfer hooks (ERC777, ERC223, pNetwork PNT) turns a benign-looking payout into a repeatable drain.