ERC-777/1155/721 hook without reentrancy guard
Beefy Finance's assessment for RD-F-015 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
BeefyVaultV7 accepts arbitrary ERC-20 as want. If a vault wraps an ERC-777 token, the tokensReceived hook on withdrawal could trigger reentrancy given withdraw() lacks nonReentrant. No specific ERC-777 vault confirmed with live TVL, but architecture permits it. Risk is structural.
Sources #
- GitHubBeefyVaultV7.solBeefyVaultV7.sol — want() is IStrategyV7.want(), accepts arbitrary ERC-20; withdraw() lacks nonReentrantretrieved 2026-05-16
Methodology #
Determine whether the protocol integrates token standards with callbacks (ERC-777 tokensReceived, ERC-1155 onReceived, ERC-721 onReceived) without reentrancy guards on the affected functions.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol beefy factor RD-F-015 score yellow collected_at 2026-05-16 13:10:30