Users can burn delegated tokens using re-entrancy attack
When a user burns tokens, the following code is called:\\n```\\n        uint locked = \\_getAndUpdateLockedAmount(from);\\n        if (locked > 0) {\\n            require(\\_balances[from] >= locked.add(amount), "Token should be unlocked for burning");\\n        }\\n//-------------------------------------------------------------------------\\n\\n        \\_callTokensToSend(\\n            operator, from, address(0), amount, data, operatorData\\n        );\\n\\n        // Update state variables\\n        \\_totalSupply = \\_totalSupply.sub(amount);\\n        \\_balances[from] = \\_balances[from].sub(amount);\\n```\\n\\nThere is a callback function right after the check that there are enough unlocked tokens to burn. In this callback, the user can delegate all the tokens right before burning them without breaking the code flow.
Resolution\\nMitigated in skalenetwork/skale-manager#128\\n`_callTokensToSend` should be called before checking for the unlocked amount of tokens, which is better defined as Checks-Effects-Interactions Pattern.
```\\n        uint locked = \\_getAndUpdateLockedAmount(from);\\n        if (locked > 0) {\\n            require(\\_balances[from] >= locked.add(amount), "Token should be unlocked for burning");\\n        }\\n//-------------------------------------------------------------------------\\n\\n        \\_callTokensToSend(\\n            operator, from, address(0), amount, data, operatorData\\n        );\\n\\n        // Update state variables\\n        \\_totalSupply = \\_totalSupply.sub(amount);\\n        \\_balances[from] = \\_balances[from].sub(amount);\\n```\\n