What is a reentrancy attack?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 6 min
In short
A reentrancy bug lets a contract be re-entered while it is still in the middle of calling out to another contract, breaking the consistency of its balances. It is a well-known ordering flaw that audits and verification tools look for specifically. As a user, what you control is choosing audited, battle-tested protocols and not concentrating funds in one place.
Key points
- A contract is re-entered mid-way through an external call
- The root cause is the order of state update and payout
- One of the first things audits and scanners check for
- Users mitigate it by choosing audited protocols and spreading funds
Definition
A vulnerability in which a contract calls out to an external address and that call re-enters the original function before its internal state has been updated, so the logic runs again on stale values.
Smart contracts can call other contracts, and the callee may run arbitrary logic — including calling straight back into the original function. If the first call has not yet written its state update, the second pass runs against stale values and the accounting no longer holds.
A major early Ethereum incident made the pattern famous, and 'update state before making external calls' became a basic discipline, usually backed by a lock that forbids re-entry while a function is running. Even so, new variants keep appearing where calls span several protocols.
Your job as a user is not to read the code. It is to weigh how long a protocol has run, how much it holds, whether several independent audits exist, whether a bug bounty is actively paid out, and how the team handled past incidents. Higher yields on newer designs are, in part, payment for the unproven parts.
Diversification does real work here. Avoid putting everything into one protocol, limit how long funds sit there, and check audit reports and announcements for the places you use. None of that removes a vulnerability, but it caps what an unexpected one can cost you.
Watch out for
- · Choose protocols with a track record and more than one independent audit before depositing
- · Never put the whole balance into one protocol; split by venue and by time
- · Follow announcements and audit updates for protocols you use, and withdraw early when something looks wrong