This guide provides a comprehensive analysis of reentrancy vulnerabilities with examples. Learn how reentrancy works and how to identify it in real protocols.
Glossary definition
Checks-Effects-Interactions
Checks-Effects-Interactions is a smart contract ordering pattern: validate conditions, commit internal state changes, then call external code.
The pattern narrows the window in which an external callee can observe or act on inconsistent state. A withdrawal, for example, should validate the balance, reduce that balance, and only then transfer control to the recipient.
CEI is a reasoning tool rather than a universal patch. Cross-contract state, token callbacks, intentionally deferred accounting, and calls made by a later layer can reintroduce the same class of problem. Guards, pull-payment designs, and post-call assertions may still be appropriate. Solidity’s security considerations use the pattern in their reentrancy guidance.
Used in context
Articles using this term.
Learn how attackers can exploit reentrancy vulnerabilities in ERC-1155 implementations to drain vault contracts, with an example real-world attack scenario.
In this article, we'll examine how attackers can manipulate the _safeMint function's external call to bypass minting limits and drain NFT collections.
In this blog, we describe reentrancy attacks in the ERC-777 standard. ERC-777 is a standard for fungible tokens with a hook for transferring – learn more here.
A cross-chain reentrancy attack is an exploit that targets smart contract function calls. Learn about this vulnerability to keep your code safe from attackers.
A read-only reentrancy attack manipulate a smart contracts to extract value. Let's take a closer look at this vulnerability and how to prevent it.
This research article reviews how cross contract reentrancy attacks work, an attack example, and guidance on how to prevent cross contract reentrancy attacks.…
What is a cross function reentrancy attack? Cross-function reentrancy attacks use multiple functions to execute the attack, which can occur when inappropriate…
![The vulnerable Vault withdrawal code beside a recursive call-stack graph showing repeated withdraw frames reading the same balance before any frame reaches balances[msg.sender] equals zero.](/_astro/hero.BjCEFGsd_2u77Pn.png)
What is a reentrancy attack? A reentrancy attack is very specific to smart contracts due to the nature of external calls. When a contract interacts with another…