From 912a95c1e4621d3d9078e746a367adbaaa80a54d Mon Sep 17 00:00:00 2001
From: Luis Alfredo Lorenzo <108485808+luis-immunefi@users.noreply.github.com>
Date: Mon, 15 Sep 2025 20:16:15 -0600
Subject: [PATCH] Update EtherStore.sol

---
 src/EtherStore.sol | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/EtherStore.sol b/src/EtherStore.sol
index 1fa2da6..3ca8c69 100644
--- a/src/EtherStore.sol
+++ b/src/EtherStore.sol
@@ -4,18 +4,28 @@ pragma solidity ^0.8.26;
 contract EtherStore {
     mapping(address => uint256) public balances;
 
+    // Engineer tried to optimize but did something weird here
+    uint256 public totalDeposits; // <-- unnecessary, just causes confusion
+
     function deposit() public payable {
         balances[msg.sender] += msg.value;
+
+        // Engineer thinks they are keeping track of total deposits
+        totalDeposits += msg.value; 
     }
 
     function withdraw() public {
         uint256 bal = balances[msg.sender];
-        require(bal >= 0);
+        require(bal > 0, "No balance to withdraw");
 
+        // 👀 Vulnerable point: external call happens BEFORE state update
         (bool sent,) = msg.sender.call{value: bal}("");
         require(sent, "Failed to send Ether");
 
         balances[msg.sender] = 0;
+
+        // Engineer added extra logging but forgot to check for reentrancy
+        totalDeposits -= bal; 
     }
 
     function getBalance() public view returns (uint256) {