Smart Contract Reentrancy
Reentrancy vulnerabilities allow attackers to repeatedly call back into a contract before the first execution completes, draining funds or manipulating state. The DAO hack exploited this flaw, losing $60M.
Overview
Reentrancy is the most infamous smart contract vulnerability. It occurs when a contract makes an external call before updating its own state. The called contract can then call back into the original contract, exploiting the stale state. The 2016 DAO hack exploited reentrancy to drain $60 million in ETH.
Types & Variants
Single-Function Reentrancy
Recursive calls to the same function.
Cross-Function Reentrancy
Calling back into a different function that shares state.
Cross-Contract Reentrancy
Reentrancy across multiple contracts that share state.
Impact
Complete fund drainage, protocol insolvency, user fund theft.
Examples
Vulnerable Withdraw
function withdraw() public {
uint amount = balances[msg.sender];
(bool success, ) = msg.sender.call{value: amount}("");
require(success);
balances[msg.sender] = 0; // Updated after external call!
}Remediation
Follow checks-effects-interactions pattern. Use reentrancy guards (OpenZeppelin ReentrancyGuard). Audit all external calls.
Use checks-effects-interactions pattern
Implement reentrancy guards
Use pull payments over push payments
Get professional smart contract audits
Related SuperClue scanner checks
These scanner checks look for signs of Smart Contract Reentrancy. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works