1

It's well known that calling an external function before changing something in the contract causes a security problem called "reentrancy vulnerability".

Does calling an external function through a view member of an interface cause reentrancy vulnerability?

Improve this question

3 Answers 3

Reset to default
3

Funnily enough I just came searching for an answer to this myself. As I understand it, there is no reentrancy vulnerability in a conventional sense because a view member cannot modify state.

Improve this answer
1
  • But can a modifying function be called through a view interface member?
    – porton
    Commented Jan 23, 2021 at 19:54
3

Calls through view members of interfaces are done through STATICCALL opcode. As my experiment confirmed Solidity 0.6.0 does use STATICCALL in this case.

https://github.com/ethereum/EIPs/blob/master/EIPS/eip-214.md

To increase smart contract security, this proposal adds a new opcode that can be used to call another contract (or itself) while disallowing any modifications to the state during the call (and its subcalls, if present).

So, there is no such vulnerability in the current versions of Solidity.

However, old versions of Solidity are vulnerable. See this Ethereum pull request for the change done in the past.

Improve this answer
1

View functions cannot modify the state, as specified here. It means that they cannot make any permanent change to the blockchain such as changing the ether or tokens balances. Therefore, reentrancy is not an issue with View functions.

Improve this answer
5
  • But can a modifying function be called through a view interface member?
    – porton
    Commented Jan 23, 2021 at 19:54
  • A view function cannot call a function that is not itself a view or pure function, so no (see the documentation linked in the answer).
    – Undead8
    Commented Jan 24, 2021 at 20:40
  • I asked about a view interface member, not about a view function.
    – porton
    Commented Jan 24, 2021 at 22:56
  • Aren't interface just functions without implementation? They don't do anything until they are implemented, and then become view functions that cannot change the state.
    – Undead8
    Commented Jan 27, 2021 at 2:14
  • My question is what happens if a hacker passes to my user a contract with non-view function through my view interface member.
    – porton
    Commented Jan 27, 2021 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.