Reentrancy: Classic & Cross-Function

What you'll learn

• The DAO: Where It All Started
• Checks-Effects-Interactions (CEI)
• ReentrancyGuard: The Belt-and-Suspenders Defense
• Read-Only Reentrancy
• Cross-Function and Cross-Contract Reentrancy
• Solidity 0.8.x and Modern Defenses

Key terms

Reentrancy

A class of vulnerability where a contract makes an external call before fully updating its own state, allowing the called contract to re-enter and exploit the inconsistent state — the bug class that drained The DAO in June 2016.

The DAO hack

June 17, 2016 exploit that drained roughly 3.6 million ETH (~$60M at the time) from The DAO via reentrancy. Led to the contentious July 20, 2016 hard fork that produced today's Ethereum / Ethereum Classic split.

Checks-Effects-Interactions (CEI)

The canonical defense pattern for reentrancy: validate inputs first (checks), then update all state (effects), then make external calls last (interactions). Ensures any reentrant call sees fully-updated state.

ReentrancyGuard

OpenZeppelin's mutex-based reentrancy lock, exposed via the nonReentrant modifier. Reverts if any guarded function is called recursively. ReentrancyGuardTransient (2024) uses EIP-1153 transient storage for lower gas.

Read-only reentrancy

A reentrancy variant where the attacker exploits view functions that return stale or inconsistent state during a multi-step external call, often to manipulate a different protocol that reads that view as a price oracle. Implicated in the July 2023 Curve incident.

Cross-function reentrancy

Reentrancy that re-enters a different function on the same contract — not the originally-called function — to exploit shared state. Defeated by applying the same reentrancy lock to all functions that touch the same state.

Cross-contract reentrancy

Reentrancy across contract boundaries within a protocol, where a guard on contract A doesn't protect the state in contract B that A interacts with.

Solidity 0.8.x built-in overflow checks

Since Solidity 0.8.0 (Dec 16, 2020), arithmetic over/underflow reverts by default, eliminating the need for SafeMath. The unchecked { } block opts out for performance.

EIP-1153 transient storage

Transaction-scoped storage that resets at end of transaction, shipped in the Dencun upgrade (March 13, 2024). Used in ReentrancyGuardTransient for substantially cheaper reentrancy locks.

ERC-777 hook reentrancy

Token standards with transfer callbacks (ERC-777, ERC-1363) can re-enter on every transfer. Famously exploited against Uniswap V1 imBTC and others; one reason ERC-777 is now generally discouraged.