Read-Only Reentrancy
Read-only reentrancy is a vulnerability where an attacker calls a view function on a contract while that contract is in an inconsistent state due to an ongoing transaction. Because view functions do not modify state, they are often not protected by reentrancy guards, yet they can return incorrect data if the contract is in the middle of a complex update.
If another protocol relies on this view function to determine price or collateral value, the attacker can trick that protocol into taking an action based on stale or manipulated data. This vulnerability demonstrates how security issues can propagate across protocols through interconnected calls.
Preventing it requires ensuring that view functions return accurate data even during state updates or that other protocols do not rely on potentially inconsistent states. It is a critical consideration for composable DeFi systems where multiple protocols interact.