Can this function be subject to a reentrancy attack? Are there simple code smells for identifying them?

    function collect() external {
        payable(owner()).call{value: address(this).balance}("");

1 Answer 1


Yep, it is. The function that sends ether to an external contract without any state checks and changes before can end up in fallback()/receive(), where a malicious actor is free to implement the logic he wishes that can either break the logic or simply steal the funds. If I'm not mistaken the default linter has a reentrancy checker.

One way to tackle it is to enforce some state value which you will have to change on calling the function prior to call. You can also use Reentrancy Guard from openzeppelin library: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/security/ReentrancyGuard.sol

By looking through it you can also understand the mechanics of reentrancy attack better.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.