Reentrancy Attacks

A reentrancy attack occurs when an external contract calls back into the calling contract before the first invocation of the function is finished. This exploit allows the attacker to manipulate the contract state, often repeatedly withdrawing funds or tokens before the contract can update the user balance.

It typically targets functions that perform external calls to untrusted contracts before updating internal variables. In the world of DeFi, this is a notorious vulnerability that has led to significant financial losses in various protocols.

Attackers leverage the asynchronous nature of blockchain execution to bypass standard balance checks. Once the contract sends ether or tokens to the attacker, the attacker's fallback function is triggered, which recursively calls the vulnerable function again.

Because the balance has not been reduced yet, the contract mistakenly approves the additional withdrawals. This cycle continues until the contract is drained or gas limits are reached.

Proper use of non-reentrant modifiers and adherence to the checks-effects-interactions pattern are the standard defenses against this exploit. It remains a primary focus for security auditors and developers building financial infrastructure.