Following code shows reading of balance:

function WithdrawBuggy(uint256 amount) public {
   uint256 bal = balance[msg.sender];
   require(amount <= bal);
   balance[msg.sender] -= amount;
   if (balance[msg.sender] != bal) {
      emit BalanceDecreased(msg.sender);

Can the attacker exploit reading of balance?



When the caller is an smart contract if it can re-enter BuggyWithdraw and can change balance[msg.sender] then it will be possible that BalanceDecreased is never emitted.

So an off-chain service that relies on that event might not take into account the balance has decreased.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.