Callback Function Vulnerability
A callback function vulnerability occurs in smart contracts when an external contract is allowed to execute code during a transaction before the original function has finished its own state updates. In the context of decentralized finance, this is most famously associated with reentrancy attacks.
When a protocol sends tokens or ether to an external address, that address can trigger a fallback function to call back into the original contract. If the original contract has not yet updated the user balance or internal state, the attacker can repeatedly withdraw funds before the initial transaction concludes.
This exploits the sequence of execution within the Ethereum Virtual Machine. It is a critical risk in lending protocols and automated market makers where state consistency is paramount.
Developers must use checks-effects-interactions patterns or reentrancy guards to prevent this. Failure to do so allows attackers to drain liquidity pools rapidly.
This vulnerability represents a failure to account for the asynchronous and composable nature of smart contracts. It remains one of the most common reasons for high-profile exploits in the cryptocurrency ecosystem.