The deposit function is not following CEI pattern
The protocol implemented a function `deposit()` to allow users to deposit.\\n```\\nDepositVault.sol\\n    function deposit(uint256 amount, address tokenAddress) public payable {\\n        require(amount > 0 || msg.value > 0, "Deposit amount must be greater than 0");\\n        if(msg.value > 0) {\\n            require(tokenAddress == address(0), "Token address must be 0x0 for ETH deposits");\\n            uint256 depositIndex = deposits.length;\\n            deposits.push(Deposit(payable(msg.sender), msg.value, tokenAddress));\\n            emit DepositMade(msg.sender, depositIndex, msg.value, tokenAddress);\\n        } else {\\n            require(tokenAddress != address(0), "Token address must not be 0x0 for token deposits");\\n            IERC20 token = IERC20(tokenAddress);\\n            token.safeTransferFrom(msg.sender, address(this), amount);//@audit-issue against CEI pattern\\n            uint256 depositIndex = deposits.length;\\n            deposits.push(Deposit(payable(msg.sender), amount, tokenAddress));\\n            emit DepositMade(msg.sender, depositIndex, amount, tokenAddress);\\n        }\\n    }\\n```\\n\\nLooking at the line L47, we can see that the token transfer happens before updating the accounting state of the protocol against the CEI pattern. Because the protocol intends to support all ERC20 tokens, the tokens with hooks (e.g. ERC777) can be exploited for reentrancy. Although we can not verify an exploit that causes explicit loss due to this, it is still highly recommended to follow CEI pattern to prevent possible reentrancy attack.
Handle token transfers after updating the `deposits` state.
```\\nDepositVault.sol\\n    function deposit(uint256 amount, address tokenAddress) public payable {\\n        require(amount > 0 || msg.value > 0, "Deposit amount must be greater than 0");\\n        if(msg.value > 0) {\\n            require(tokenAddress == address(0), "Token address must be 0x0 for ETH deposits");\\n            uint256 depositIndex = deposits.length;\\n            deposits.push(Deposit(payable(msg.sender), msg.value, tokenAddress));\\n            emit DepositMade(msg.sender, depositIndex, msg.value, tokenAddress);\\n        } else {\\n            require(tokenAddress != address(0), "Token address must not be 0x0 for token deposits");\\n            IERC20 token = IERC20(tokenAddress);\\n            token.safeTransferFrom(msg.sender, address(this), amount);//@audit-issue against CEI pattern\\n            uint256 depositIndex = deposits.length;\\n            deposits.push(Deposit(payable(msg.sender), amount, tokenAddress));\\n            emit DepositMade(msg.sender, depositIndex, amount, tokenAddress);\\n        }\\n    }\\n```\\n