F-2025-0017·cei-violation

Inconsistent use of checks-effects-interactions (CEI) pattern in _processPayment

Fixednfterc721erc20
TL;DR

_processPayment updates remaining after the external transfer to platformTreasury, deviating from the checks-effects-interactions discipline.

Severity
INFO
Impact
LOW
Likelihood
LOW
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

In _processPayment, there is a CEI issue. The current version updates state (remaining -= feeAmount) after the external call:

solidity
if (feeAmount > 0) {
(bool sentFee, ) = platformTreasury.call{value: feeAmount}("");
require(sentFee, "Failed to send platform fee");
remaining -= feeAmount;
}

In the _processPayment function, the suggested solution is to move the remaining -= feeAmount line before the external call.

03Section · Impact

Impact

Best-practice deviation; while the contract's existing reentrancy guards mitigate the risk in current call paths, the ordering should be corrected to keep the CEI discipline intact for future maintainers and any path that may bypass the guard.

04Section · Recommendation

Recommendation

Reorder so that the state update is applied before the external call:

solidity
if (feeAmount > 0) {
remaining -= feeAmount;
(bool sentFee, ) = platformTreasury.call{value: feeAmount}("");
require(sentFee, "Failed to send platform fee");
}
05Section · Resolution

Resolution

Ipal Network: Confirmed. We agreed with the recommendation to adhere strictly to the checks-effects-interactions pattern.

Zealynx: Not Fixed: The CEI pattern violation remains. State updates (remaining -= feeAmount) still occur after external calls, which goes against the recommended checks-effects-interactions pattern for security best practices.

UPDATE: Fixed.

Status
Fixed
F-2025-0017

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx