1

I'm trying to understand the mechanism for a reentrancy attack, and how it might be mitigated. I'm looking at (for example) this scan result: https://de.fi/scanner/contract/0xab46a03d8B82F6f8551d05FfA5E071cAfB313e5D?chainId=arbi

I'd love to understand 1) Why/How does the WETHGateway Reentrancy vulnerability work? 2) What does it mean "No relevant code execution after reentrancy expression.", and what would the "bad" counterexample look like?

Thanks!

Improve this question

1 Answer 1

Reset to default
2

There's no vulnerability because the contract doesn't do anything after the external call.

There's a possibility of a re-entrancy bug only if you violate the Checks-Effects-Interactions pattern. As a rule of thumb, if in your function you don't mix these ones in a different order, then you're good.

In your example, the interaction (the external call) is at the end of the function, so you don't violate the pattern. That's what the analyzer means by saying there's no relevant code after the external call.

Improve this answer
2
  • Thank you! Follow up question. Is there a way to avoid the scanner flagging it at all?
    – Abraham P
    Commented Dec 27, 2023 at 11:59
  • I don't know, you should ask the developers of the scanner.
    – 0xSanson
    Commented Dec 27, 2023 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.