Problem with reading balance

Question

Following code shows reading of balance:

function WithdrawBuggy(uint256 amount) public {
   uint256 bal = balance[msg.sender];
   require(amount <= bal);
   balance[msg.sender] -= amount;
   require(msg.sender.call.value(amount)());
   if (balance[msg.sender] != bal) {
      emit BalanceDecreased(msg.sender);
   }
} 

Can the attacker exploit reading of balance?

Zulfi.

Answer 1

When the caller is an smart contract if it can re-enter BuggyWithdraw and can change balance[msg.sender] then it will be possible that BalanceDecreased is never emitted.

So an off-chain service that relies on that event might not take into account the balance has decreased.