Reentrancy in `transfer` and `transferFrom` functions could lead to an attacker to repeatedly withdraw tokens, potentially draining the contract's token balance.
Audit: 2023-09-centrifuge-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/LiquidityPool.sol#L301-L305
https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/LiquidityPool.sol#L295-L299


# Vulnerability details

## Impact

It can lead to a significant loss of tokens for users of the `LiquidityPool` contract an attacker can repeatedly withdraw tokens, potentially draining the contract's token balance.

## Proof of Concept

The contract allows users to deposit and withdraw assets, and it interacts with the ERC20 token using `transfer` and `transferFrom`. These functions can trigger external contract calls. If users or other contracts call external functions in response to token transfers, it could lead to reentrancy attacks.

The potential area of concern where reentrancy attacks could occur is in functions that interact with external contracts, particularly when using `transfer` and `transferFrom` functions from an ERC20 token. Reentrancy vulnerabilities typically involve external contract calls made within the context of these functions.

- In the **[transfer](https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/LiquidityPool.sol#L301-L305)** function.
```solidity
    function transfer(address, uint256) public returns (bool) {
        (bool success, bytes memory data) = address(share).call(bytes.concat(msg.data, bytes20(msg.sender)));
        _successCheck(success);
        return abi.decode(data, (bool));
    }
```

- In the **[transferFrom](https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/LiquidityPool.sol#L295-L299)** function.
```solidity
    function transferFrom(address, address, uint256) public returns (bool) {
        (bool success, bytes memory data) = address(share).call(bytes.concat(msg.data, bytes20(msg.sender)));
        _successCheck(success);
        return abi.decode(data, (bool));
    }
```

```solidity
(bool success, bytes memory data) = address(share).call(bytes.concat(msg.data, bytes20(msg.sender)));
```
This line appears in both the `transferFrom` and `transfer` functions within your contract. It uses the low-level `call` function to invoke the `transfer` method on the `share` contract. The content of `msg.data` contains the function call data, and `msg.sender` is included as part of the call.

**Vulnerability Details:**

1. **Reentrant MaliciousContract:** The `MaliciousContract` is designed to initiate a reentrancy attack on the `LiquidityPool` contract. It accomplishes this by having a fallback function that calls the `withdraw` function of the `LiquidityPool` contract before finalizing its internal state.

   ```solidity
   fallback() external {
       LiquidityPool target = LiquidityPool(msg.sender);
       // Assuming the target contract is the LiquidityPool we want to attack
       // This is a simplified example; in reality, you would need