Vulnerability: Incorrect response from price feed if called during an onERC1155Received callback  Acknowledged
Severity: medium

Description:
The ERC 1155 standard requires that smart contracts must implement `onERC1155Received` and `onERC1155BatchReceived` to accept transfers.\\nThis means that on any token received, code run on the receiving smart contract.\\nIn `NiftyswapExchange` when adding / removing liquidity or buying tokens, the methods mentioned above are called when the tokens are sent. When this happens, the state of the contract is changed but not completed, the tokens are sent to the receiving smart contract but the state is not completely updated.\\nThis happens in these cases\\n`_baseToToken` (when buying tokens)\\n```\\n// // Refund Base Token if any\\nif (totalRefundBaseTokens > 0) {\\n  baseToken.safeTransferFrom(address(this), \\_recipient, baseTokenID, totalRefundBaseTokens, "");\\n}\\n\\n// Send Tokens all tokens purchased\\ntoken.safeBatchTransferFrom(address(this), \\_recipient, \\_tokenIds, \\_tokensBoughtAmounts, "");\\n```\\n\\n`_removeLiquidity`\\n```\\n// Transfer total Base Tokens and all Tokens ids\\nbaseToken.safeTransferFrom(address(this), \\_provider, baseTokenID, totalBaseTokens, "");\\ntoken.safeBatchTransferFrom(address(this), \\_provider, \\_tokenIds, tokenAmounts, "");\\n```\\n\\n`_addLiquidity`\\n```\\n// Mint liquidity pool tokens\\n\\_batchMint(\\_provider, \\_tokenIds, liquiditiesToMint, "");\\n\\n// Transfer all Base Tokens to this contract\\nbaseToken.safeTransferFrom(\\_provider, address(this), baseTokenID, totalBaseTokens, abi.encode(DEPOSIT\\_SIG));\\n```\\n\\nEach of these examples send some tokens to the smart contract, which triggers calling some code on the receiving smart contract.\\nWhile these methods have the `nonReentrant` modifier which protects them from re-netrancy, the result of the methods `getPrice_baseToToken` and `getPrice_tokenToBase` is affected. These 2 methods do not have the `nonReentrant` modifier.\\nThe price reported by the `getPrice_baseToToken` and `getPrice_tokenToBase` methods is incorrect (until after the end of the transaction) because they rely on the number of tokens owned by the NiftyswapExchange; which between the calls is not finalized. Hence the price reported will be incorrect.\\nThis gives the smart contract which receives the tokens, the opportunity to use other systems (if they exist) that rely on the result of `getPrice_baseToToken` and `getPrice_tokenToBase` to use the returned price to its advantage.\\nIt's important to note that this is a bug only if other systems rely on the price reported by this `NiftyswapExchange`. Also the current contract is not affected, nor its balances or internal ledger, only other systems relying on its reported price will be fooled.

Impact:

Recommended mitigation:
Resolution\\nThe design will not be modified. Horizon Games should clearly document this risk for 3rd parties seeking to use Niftyswap as a price feed.\\nBecause there is no way to enforce how other systems work, a restriction can be added on `NiftyswapExchange` to protect other systems (if any) that rely on `NiftyswapExchange` for price discovery.\\nAdding a `nonReentrant` modifier on the view methods `getPrice_baseToToken` and `getPrice_tokenToBase` will add a bit of protection for the ecosystem.