I'm trying to get some sense from the hysteria around the attack performed to The DAO smart contract.

I understand the high level explanations, but I'd like to grasp how this attack was performed.

I've read somewhere that this is related to the call.value() statement, but I don't understand why this is any different from regular CALLs.

1 Answer 1


EDIT Dec 2019: call.value()() should now be used for transferring ether.

See: Is transfer() still safe after the Istanbul update (2300 gas limitation)?

The following is the original answer.

contract.call.gas(...).value(...)(...) is a way to add Ether and limit gas when invoking a contract. Basically, TheDAO used call.value to move Ether around in a generic way.

contract.call.value(...)() will invoke the fallback function at contract with almost all the gas that the caller has. In a normal call like contract.foo, if contract is untrusted, it is much clearer that untrusted code (foo) is explicitly being invoked.

Another important difference is that any exceptions in contract.foo will bubble up: if foo runs Out of Gas, that exception immediately halts the transaction and reverts all state changes. With contract.call.value(...)(), only a true or false is returned (the exception does not bubble up) and so you generally see code like if (!contract.call.value(...)()) throw;

Here's a glimpse into how the reentrant attack was performed: How was the recursion created that lead to theDAO hack?.

  • "Almost"? Why not entirely all of his gas? Commented Jun 14, 2017 at 8:29
  • 1
    @JossieCalderon "Almost" is explained in the footnote 'You cannot just say "send all my gas along with the call", you always have to give an explicit number.'
    – eth
    Commented Jun 23, 2017 at 5:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.