Give some examples of documentation that talks about reentrancy attacks / recursive call vulnerabilities

Question

The DAO, a smart-contract on Ethereum, was vulnerable to reentrancy attacks and 3 million ETH worth $50 million was stolen from it.

What are some examples of content that mentions reentrancy attacks? Specifically, older content, as the content from June 2016 and forward is easily found through Google.

Does the whitepaper or the yellowpaper or other developer documentations mention reentrancy attacks ?

Answer 1

If you are a developer or interested in recreating the attack, I've created two contracts for the purpose of demonstrating exactly how it worked. https://github.com/joeb000/mock-dao-hack

There are also some articles linked in the README file you might find helpful.

Answer 2

Before June 2016

• August 2014: Reentrant Contracts gives an example of "a contract can be tricked into calling itself".

• July 2015: LeastAuthority Ethereum Analyses mentioned:

reentrancy hazards if the callback itself executes publish(), subscribe(), or unsubscribe(): repeated actions, missing actions, and inconsistent delivery of messages

• November 2015: How to write safe smart contracts was a talk given at DevCon1, noting that sending money:

always triggers execution of fallback function ( function() { ...} )

→ make fallback function cheap

→ prepare for callbacks (can mess up your state!)