With the recent exploit on the omnipools on Conic Finance. The hacker used an exploit called: re-entrancy attack. How does it work explained in layman terms?

And what should smart contract auditors look for to prevent these similar vulnerabilities in other contracts?


1 Answer 1


The re-entrancy attack is when a user call your contract and that your contract then make an external call that could potentially come back in the contract.

Here is a simple example;

function withdraw(uint256 amount) public {
    require(balances[msg.sender]> amount, "Insuficient balance");
    token.transfer(amount, msg.sender);
    balances[msg.sender] = balances[msg.sender] - amount;

Now imagine that the msg.sender is a contract. The contract can make a call to your contract withdraw function when it receives token. This would create a loop and the balance will not get adjusted because when your contract execute the token transfer, the caller contract immediately call withdraw again.

This is why we always make external call at last.

In the example, the balance would never get adjusted so the user can keep re entering your contract and withdraw some more funds. Until the contract is empty.

There are plenty of example out there on how to avoid it.

  • Well that's a bad example cause there's no call to msg.sender made here, but you got the idea
    – Foxxxey
    Commented Jul 22, 2023 at 22:51
  • Look again! @Foxxxey Commented Jul 23, 2023 at 0:21
  • I looked again, there's still no call to msg.sender. Even if token is an ERC721, it's using transfer and not safeTransfer so msg.sender is never called @MadeInDreams
    – Foxxxey
    Commented Jul 23, 2023 at 13:15
  • token.transfer(msg.sender, amount); isnt a call to msg.sender, it's a call to token
    – Foxxxey
    Commented Jul 23, 2023 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.