René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Re-entrancy Vulnerablility","articleBody":"Credit to Liam Zebedee for finding this bug\r\n\r\nThe following if from Liam's email notifying us of the vulnerability:\r\n\r\n```\r\nExploit mechanism: Re-entrancy attacks\r\n\r\nIf the ERC20.transferFrom call is re-entrant, meaning it will maliciously call back into the Subscription, it is possible to exploit some facts:\r\n\r\n//increment the timestamp by the period so it wont be valid until then\r\n        nextValidTimestamp[subscriptionHash] = block.timestamp.add(periodSeconds);\r\n\r\nThis is executed before transferFrom - so a malicious actor (who specifically has engineered their own proxy contract to with a valid nonce/sig for re-entrant calls) can effectively extend their subscription period by periodSeconds every call. Infinite Netflix anyone?\r\n```\r\n","author":{"url":"https://github.com/captnseagraves","@type":"Person","name":"captnseagraves"},"datePublished":"2018-10-23T19:45:48.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/3/reference-client/issues/3"}