1

If an attacker batch-calls the vulnerable contract's function in a re-entrancy attack attempt, would the transaction with a CEI pattern violation be fully executed before the other transactions are processed, or can he still profit by batch-calling a contract's function?

Note: The function has no internal calls.

P.S. I need this for a POC

1 Answer 1

1

When batch calling a function, yes, it will need to fully execute before any of the next batched calls can finish. In the case of reentrancy, you could have some smart contract that launches another call from inside the reentrant function though.

For example, if you have a contract function called foo that makes a transfer call to an erc20 with transfer hooks, you can launch one transaction to foo, and inside of foo, your contract is called again from the erc20 transfer, and you can launch another call to foo inside of that call. But this is not really batch calling, more like nested or recursive calling. If you were batch calling the vulnerable function in a loop, each call would have to fully finish before you could make another call.

However, if you are talking about doing the same exploit multiple times in a row with batch calls in a for loop, for example fully drain a contract where a reentrancy attack skims 10% of a treasury or something, batch calls would indeed accomplish nearly fully draining that contract.

1
  • Thank you for the great explanation!
    – Mila A
    Commented Aug 31, 2023 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.