contract Vuln {
    mapping(address => uint256) public balances;

    function deposit() public payable {
        // Increment their balance with whatever they pay
        balances[msg.sender] += msg.value;

    function withdraw() public {
        // Refund their balance

        // Set their balance to 0
        balances[msg.sender] = 0;
  • Could you add the error log or anything that makes you think something is wrong ? – Nicolas Massart Feb 26 '19 at 10:18

It is vulnerable to a reentrancy attack.

It looks like you copied this from something like a course on solidity where they asked you this question, so check out the other known attacks on the linked page and read about reentrancy, so you do understand why it is vulnerable, instead of just knowing the answer.


Here’s an article that may help you understand why


Not the answer you're looking for? Browse other questions tagged or ask your own question.