External Call Vulnerability
An external call vulnerability occurs when a smart contract interacts with an untrusted address, allowing that address to execute arbitrary code within the context of the calling contract. This often happens during token transfers or calls to external libraries where the receiving address might be a malicious contract.
The danger lies in the ability of the receiver to trigger a callback, potentially modifying the state of the original contract before the transaction completes. In decentralized finance, this is the primary vector for reentrancy and other logic-based exploits.
Developers must assume that any external address can behave maliciously and act accordingly. Using safe interfaces and avoiding complex logic during external interactions is a key defense strategy.
It is a critical risk factor in the architecture of complex derivative protocols. Proper auditing and adherence to security best practices are required to mitigate this risk.
The design of secure systems must account for the unpredictable nature of external actors.