IdleCDO._deposit() allows re-entrancy from hookable tokens.
The function `IdleCDO._deposit()` updates the system's internal accounting and mints shares to the caller, then transfers the deposited funds from the user. Some token standards, such as ERC777, allow a callback to the source of the funds before the balances are updated in `transferFrom()`. This callback could be used to re-enter the protocol while already holding the minted tranche tokens and at a point where the system accounting reflects a receipt of funds that has not yet occurred.\\nWhile an attacker could not interact with `IdleCDO.withdraw()` within this callback because of the `_checkSameTx()` restriction, they would be able to interact with the rest of the protocol.\\n```\\nfunction \\_deposit(uint256 \\_amount, address \\_tranche) internal returns (uint256 \\_minted) {\\n  // check that we are not depositing more than the contract available limit\\n  \\_guarded(\\_amount);\\n  // set \\_lastCallerBlock hash\\n  \\_updateCallerBlock();\\n  // check if strategyPrice decreased\\n  \\_checkDefault();\\n  // interest accrued since last depositXX/withdrawXX/harvest is splitted between AA and BB\\n  // according to trancheAPRSplitRatio. NAVs of AA and BB are updated and tranche\\n  // prices adjusted accordingly\\n  \\_updateAccounting();\\n  // mint tranche tokens according to the current tranche price\\n  \\_minted = \\_mintShares(\\_amount, msg.sender, \\_tranche);\\n  // get underlyings from sender\\n  IERC20Detailed(token).safeTransferFrom(msg.sender, address(this), \\_amount);\\n}\\n```\\n
Move the `transferFrom()` action in `_deposit()` to immediately after `_updateCallerBlock()`.
```\\nfunction \\_deposit(uint256 \\_amount, address \\_tranche) internal returns (uint256 \\_minted) {\\n  // check that we are not depositing more than the contract available limit\\n  \\_guarded(\\_amount);\\n  // set \\_lastCallerBlock hash\\n  \\_updateCallerBlock();\\n  // check if strategyPrice decreased\\n  \\_checkDefault();\\n  // interest accrued since last depositXX/withdrawXX/harvest is splitted between AA and BB\\n  // according to trancheAPRSplitRatio. NAVs of AA and BB are updated and tranche\\n  // prices adjusted accordingly\\n  \\_updateAccounting();\\n  // mint tranche tokens according to the current tranche price\\n  \\_minted = \\_mintShares(\\_amount, msg.sender, \\_tranche);\\n  // get underlyings from sender\\n  IERC20Detailed(token).safeTransferFrom(msg.sender, address(this), \\_amount);\\n}\\n```\\n