Crypto glossary
Reentrancy attack
A reentrancy attack is a smart contract exploit in which a malicious contract calls back into its victim repeatedly before balances are updated.
The bug appears when a contract sends funds or calls an external contract before updating its own records. The receiving contract can run code at that moment and call the original function again. Since the balance has not yet been reduced, the victim pays out again, and the loop continues until the funds are gone or the transaction runs out of gas.
It is the attack behind The DAO hack of June 2016, in which about 3.6 million ETH were moved, leading to the hard fork that split Ethereum and Ethereum Classic. Variants keep appearing: in July 2023 a bug in some versions of the Vyper compiler disabled reentrancy locks, and several Curve pools were drained.
Developers prevent it by following the checks-effects-interactions pattern, which updates state before any external call, and by adding reentrancy guards that block a function from being entered twice. Auditors test for it routinely, yet it still surfaces in complex systems with many interacting contracts.
Example
A vault pays out 10 ETH before setting the user's balance to zero; the attacker's contract re-enters the withdraw function ten times in the same transaction and takes 100 ETH.
