contract Vuln {
    mapping(address => uint256) public balances;

    function deposit() public payable {
        // Increment their balance with whatever they pay
        balances[msg.sender] += msg.value;

    function withdraw() public {
        // Refund their balance

        // Set their balance to 0
        balances[msg.sender] = 0;

closed as unclear what you're asking by Nicolas Massart, goodvibration, shane, Achala Dissanayake, Ismael Feb 27 at 7:40

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Could you add the error log or anything that makes you think something is wrong ? – Nicolas Massart Feb 26 at 10:18

It is vulnerable to a reentrancy attack.

It looks like you copied this from something like a course on solidity where they asked you this question, so check out the other known attacks on the linked page and read about reentrancy, so you do understand why it is vulnerable, instead of just knowing the answer.


Here’s an article that may help you understand why


Not the answer you're looking for? Browse other questions tagged or ask your own question.