Security review — 3 potential issues found

[aldiboncel49-lgtm]

Security concerns in MystenLabs/sui

I was looking through the codebase and found a few patterns that might be security-sensitive. Targeting this to Bug Bounty if it hasn't been caught already.

Found 40 items total: 0 critical, 3 high, 5 medium, 32 low.

---

reentrancy — bridge/evm/contracts/SuiBridgeV2.sol line 152

Severity: HIGH

Language: Solidity

Potential reentrancy — external call before state update

(bool success,) = payable(address(vault)).call{value: amount}("");

reentrancy — bridge/evm/contracts/SuiBridge.sol line 210

Severity: HIGH

Language: Solidity

Potential reentrancy — external call before state update

(bool success,) = payable(address(vault)).call{value: amount}("");

reentrancy — bridge/evm/contracts/BridgeVault.sol line 62

Severity: HIGH

Language: Solidity

Potential reentrancy — external call before state update

(bool success,) = recipientAddress.call{value: amount}("");

---

Some of these might be false positives — just wanted to put them on your radar. Happy to provide more context if any of these look actionable.

[github-actions]

Thank you for opening this issue, a team member will review it shortly. Until then, please do not interact with any users that claim to be from Sui support and do not click on any links!