Questions tagged [reentrant-attacks]

Questions related to "reentrancy vulnerability" or "reentrant attack", where untrusted code reenters a contract and manipulates state. http://forum.ethereum.org/discussion/1317/reentrant-contracts https://github.com/LeastAuthority/ethereum-analyses/blob/master/GasEcon.md

Filter by
Sorted by
Tagged with
1 vote
1 answer
26 views

Reentrancy Guard and CEI

Could you please explain, is there a need to use a ReentrancyGuard modifier if the contract follows the CEI(Check Effect Interactions) pattern? If yes, could you bring an example, where the contract ...
Mark's user avatar
  • 13
0 votes
0 answers
25 views

Failed to demonstrate a Re-entrancy attack due to arithmetic underflow

I try to do re-entrancy on a contract for testing purposes, but I encountered an error when doing so. Here's the targeted contract // SPDX-License-Identifier: MIT pragma solidity ^0.8.20; import {...
elpabl0's user avatar
1 vote
1 answer
48 views

Understanding Reentrancy attacks

I'm trying to understand the mechanism for a reentrancy attack, and how it might be mitigated. I'm looking at (for example) this scan result: https://de.fi/scanner/contract/...
Abraham P's user avatar
  • 103
0 votes
1 answer
59 views

About how reentrancy works?

I tried investigating reentrancy and found something unexpected. I tried preventing reentrancy with reentrancy locks as recommended. When I ran the code, there was no error due to attempted reentrancy ...
Manish Adhikari's user avatar
0 votes
1 answer
16 views

Reentrancy check on external call

If I have two external functions in two contracts (A and B), where A calls B, B's called function has an onlyA() modifier, and B's called function sends ETH to an external address, is it logical to ...
dNyrM's user avatar
  • 912
0 votes
0 answers
7 views

reentrancy vulnerability Replication Failure

Vulnerability replication fails, returns false when calling Amoney.withdraw via the Battack contract, and fails to trigger the fallback function.help! //victim contract // SPDX-License-Identifier: MIT ...
chase's user avatar
  • 1
0 votes
0 answers
15 views

Is using OZ's ReentrancyGuard contract infallible?

Are there any know ways to exploit reentry even if a contract is using Reentrancyguard from OpenZeppelin? This is for an audit contest...it's not me trying to exploit anything.
auditor_chick's user avatar
0 votes
1 answer
38 views

Does the OpenZeppelin nonReentrant modifier block calling all functions that have the modifier on them, or it keeps a separate state for each function

Would the nonReentrant modifier from the OpenZeppelin ReentrancyGuard library prevent the user from calling stake() when the unstake() function hasn't yet been fully processed (in the example below)? ...
Mila A's user avatar
  • 932
1 vote
1 answer
114 views

Is it possible to batch-call the function multiple times so it's executed asynchronously and make profit from that?

If an attacker batch-calls the vulnerable contract's function in a re-entrancy attack attempt, would the transaction with a CEI pattern violation be fully executed before the other transactions are ...
Mila A's user avatar
  • 932
0 votes
0 answers
15 views

Is it safe to perform ETH transfers within a library

Would it be safe to perform ETH transfers in a linked library instead of within the original contract to save contract size? Also, if the low level call to the receiver from the library triggers the ...
Sheeshco's user avatar
0 votes
1 answer
42 views

What is an re-entrancy attack and how does it work?

With the recent exploit on the omnipools on Conic Finance. The hacker used an exploit called: re-entrancy attack. How does it work explained in layman terms? And what should smart contract auditors ...
Patoshi パトシ's user avatar
1 vote
0 answers
29 views

Can I trust that the value of address(this).balance is up-to-date if the function that transfers eth based on it is under a re-entrancy attack?

Is this function a secure way of transferring the locked value to the winner? function resolve(bool _chooseHead, uint _randomNumber) public { require(msg.sender == partyA); require(keccak256(...
Mila A's user avatar
  • 932
0 votes
1 answer
155 views

Testing the OpenZeppelin ReentrancyGuard

I have a contract, which is using ReentrancyGuard . Is there a way simulate reentrancy through a hardhat/mocha test? Calling a function twice without waiting for it to finish doesn't seem to be ...
iliev951's user avatar
0 votes
1 answer
46 views

Another contract is intercepting my contract calls and stealing the funds, what can it be?

This is the code I have, and I deployed to polygon mainnet to test. https://polygonscan.com/address/0x3CC3F39cc2386a8847378F4022917B3bB623BAFD // SPDX-License-Identifier: MIT // An example of a ...
Tsss's user avatar
  • 1
1 vote
2 answers
44 views

Can a simple ether refund without storage checks be hackable(reentrancy attack, ...)?

As the title says, I am wondering if the following ether refund(using .call) can be hackable. I am not entirely sure no reentrancy attack can be performed in it, but I think so since I am not updating ...
Demain's user avatar
  • 11
0 votes
1 answer
31 views

Reentrency testing reverted

I'm trying to exploit the following contract (based on the this thread: https://twitter.com/calyptus_web3/status/1664164696809783296) through reentrency: contract Reentrency1 { mapping (address => ...
Maciej Poszywak's user avatar
0 votes
1 answer
32 views

Can OpenZeppelin Defender call nonReentrant functions?

I am getting this error running a transaction with a relayer in Open Zeppelin Defender: cannot estimate gas; transaction may fail or may require manual gas limit I know that you get this error when ...
Falcon Stakepool's user avatar
0 votes
1 answer
36 views

Identifying a Reentrancy Attack Vulnerability

Can this function be subject to a reentrancy attack? Are there simple code smells for identifying them? function collect() external { payable(owner()).call{value: address(this).balance}(&...
Emanegux's user avatar
  • 123
0 votes
0 answers
272 views

`EvmError: NotActivated` when modifying variables in fallback

I get the strange EvmError: NotActivated when I put the nonReentrant modifier, like the OZ one, on the fallback function. I need it there because I am working with Diamond Proxies which redirect all ...
urataps's user avatar
  • 91
0 votes
1 answer
340 views

When should I use ReentrancyGuard in a smart contract?

I am looking at the ReentrancyGuard smart contract from Open Zeppelin and I don't understand when I have to use it. Is it necessary in all my smart contracts or do I only have to add it in some ...
Falcon Stakepool's user avatar
1 vote
1 answer
31 views

Failing to Demonstrate a Re-entrancy attack on withdraw function?

I am constantly getting a revert error while trying to demonstrate a Re-entrancy attack on a staking contract Here is the staking contract // SPDX-License-Identifier: MIT pragma solidity ^0.8.19; ...
k191114 Muhammad Mansoor Butt's user avatar
0 votes
0 answers
8 views

What is smart contract re-entrance vulnerability?

What is re-entrance vulnerability? How can I prevent a smart contract from being re-entrant? What are some common vulnerabilities to watch out for?
PSS's user avatar
  • 537
1 vote
0 answers
43 views

Ethernaut Re-entrancy Challenge

I am currently studying on Ethernaut challenges. I could not pass reentrancy section. I tried many times with different solutions, but somehow, transactions fail. Here is the code: // SPDX-License-...
Recep Çankaya's user avatar
1 vote
1 answer
61 views

Reentrancy attack: Safe Remote Purchase

Hello everyone i am new to solidity coding, and i want to improve my security skill regarding smart contracts and evm. In order to accomplish this goal i tried a reentrancy attack on a simple contract....
ArtBalar's user avatar
1 vote
3 answers
280 views

How is re-entrancy attack done in case of ERC20 tokens instead of ETH?

I have read through multiple sources about re-entrancy attacks and I understand how the attack is done. But all the examples I found worked on ETH transfer since the attack is through receive() ...
Shubham Sharma's user avatar
0 votes
1 answer
324 views

How does reentrancy work?

I do not understand how transaction are processed sequentially and reentrancy attacks can still happen. Can someone explain this?
shitblockchaindev's user avatar
0 votes
1 answer
48 views

How does the receive function in solidity work

The below code block has a Reentrance contract and also a attack contract. Imagine the Reentrance contract already has some balance in it. Aim to to drain it to 0. But the if condition in the receive ...
user19374838's user avatar
0 votes
0 answers
22 views

Reentrancy attack

Can anyone explain this code to me //SPDX-License-Identifier: MIT pragma solidity ^0.8.7; contract ReEntrancyGuard{ address[] public addr; bool locked; function addresslist(address ...
Beep-boop-bop's user avatar
0 votes
1 answer
72 views

Is my smart contract code vulnerable to reentrancy or exploit

Hey there guys how are u , can someone help me on this ? contract Token { mapping(address => uint) public balances; mapping(address => mapping(address => uint)) public allowance; ...
Dante's user avatar
  • 1
0 votes
1 answer
29 views

questions about Re-Entrancy attack syntax

hey guys I come across this video about re-entrancy attack posted by Chainlink, but I have some questions about the syntax being covered. please help. // SPDX-License-Identifier: MIT pragma solidity ^...
Simon Zhao's user avatar
0 votes
1 answer
61 views

Reentrance attack execution reverted

I am working on ethernaut reentrancy problem Any clue why this transaction did not work ? Thanks https://mumbai.polygonscan.com/tx/0x69c19a7d14449cc5396e31d63db2c0d622acc48777592a5c423380f755d48fd0 ...
Seddik Ben Amor's user avatar
1 vote
1 answer
111 views

Fallback function not reached if call initiated from constructor

I was working on the Reentrance problem for Ethernaut and I noticed that initiating the attack from the constructor will not work. It seems that the fallback function is not reached even though both ...
0xCourtney's user avatar
-4 votes
1 answer
45 views

How can I use a reentrancy attack to permanently freeze funds?

If possible, can you please send me the code with as much details as possible? I would like to understand more about it but didn't find useful content on the internet. Thanks in advance
Joe B's user avatar
  • 3
1 vote
0 answers
19 views

Safety of writing fund transfer and NFT transfer code in an externally linked library

If suppose there is a main contract A that is linked to an external library L, would it be safe to move all the fund transfer and NFT transfer calls from the main contract into the library to reduce ...
Sheeshco's user avatar
1 vote
1 answer
498 views

Code in ReentrancyGuard.sol unreachable

// SPDX-License-Identifier: MIT pragma solidity ^0.8.17; import "@openzeppelin/contracts/security/ReentrancyGuard.sol"; contract SavingsContract is ReentrancyGuard{ address owner; uint8 ...
f22daniel's user avatar
  • 333
1 vote
2 answers
696 views

Can ReentrancyGuard be used in Proxies?

ReentrancyGuard's _status is set in the constructor & we can't set it anywhere else: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/64e48203cecad94f02de9891ecdeed4d629c6dae/contracts/...
DiamondDust's user avatar
0 votes
2 answers
809 views

How to ".call" a function of another contract which uses ".call"

So, I'm learning advanced smart contract development. Two days ago, I learned about Reentrancy attacks and then I also created two contracts Protocol.sol (vulnerable contract) + Hacker.sol (attacker ...
DevABDee's user avatar
  • 441
0 votes
1 answer
87 views

Possibility of a reentrancy attack when sending funds through a libraries external function

I want to know if this code is susceptible to a reentrancy attack. I am deploying a contract A that holds a certain amount of funds. I have added a function that calls upon a linked library and I have ...
Sheeshco's user avatar
1 vote
0 answers
40 views

how import in remix smart contract without source code?

I am trying to call a fallback function on a smart contract that has not verified contract source code, How can I do this? Thanks in advance
tomas's user avatar
  • 31
3 votes
2 answers
598 views

How to write a function that performs reentrant calls to an ERC20 token transfer() and transferFrom() functions?

Description I was writing security tests for an ERC20 token. I was researching online about reentrancy attacks and found that it is mainly accomplished by using a fallback() or receive() function in ...
Ayan W3Dev's user avatar
1 vote
2 answers
975 views

Attack on ERC-777 smart contract and UniswapV2Pair resulting in 104 ETH liquidity drain

My ERC-777 smart contract (Schnoodle, symbol SNOOD) was attacked yesterday resulting in the entire liquidity in the UniswapV2Pair token being drained (104 ETH). The attack was by way of an attacker ...
Neo's user avatar
  • 158
0 votes
1 answer
33 views

Re-entrance attack and run out of the gas, should revert the state?

How the re-entrance attack (using .call) is able to change the state by using recursive call until it runs out of the gas (and it never reaches to the subsequent line to throw the exception). I ...
NoodleX's user avatar
  • 101
1 vote
0 answers
108 views

Is updating states before an action, such as transfers, a flat-out rule to follow to avoid reentrancy? Are there scenarios to not follow this rule?

I understand that many websites advocate that the best practice is to always place any updating of states before the actual action (such as a transfer) to prevent reentracy problems. But is this a ...
xenon's user avatar
  • 455
0 votes
1 answer
220 views

address.transfer() fails, while address.call{}() works fine in reentrancy attack. Why?

I was trying to learn reentrancy attacks and how to save the contracts against them. I previously user address.transfer() to withdraw the amount, but the function reverted when performing the attack. ...
Shubham Sharma's user avatar
3 votes
2 answers
3k views

Can ERC-20 token transfers have re-entrancy?

I understand that re-entrance attack can happened when you send ETH, because of fallback() function. But in ERC20 transfer there is no call for fallback, so I wonder if there's a way to make re-...
Shaketh's user avatar
  • 31
1 vote
0 answers
41 views

Contract scoped memory variables in solidity

By my research I haven't found a way to have contract scoped memory variables. My objective is to have a mutex like the one described here https://www.blunderingcode.com/writing-secure-solidity/ but ...
josue.0's user avatar
  • 113
1 vote
1 answer
1k views

How to implement a withdraw function using call{value} and divide between accounts

This best practice recommends using something like: address private constant WALLET_A = 0xabcdabcdacbdbabskbkashda; function withdraw() public onlyOwner { (bool success, ) = WALLET_A.call{value: ...
user1087973's user avatar
1 vote
0 answers
140 views

Reentrancy attack exercise does not work

I’m trying to solve the reentrancy exercise from the Ethernaut project - https://ethernaut.openzeppelin.com/level/0xe6BA07257a9321e755184FB2F995e0600E78c16D. I created a hacking contract but it does ...
Sayaki's user avatar
  • 139
1 vote
1 answer
357 views

Meaning of fowarding gas to the fallback function and its relationship with the reentrancy attack

I am reading https://solidity-by-example.org/fallback/ and the difference between send, transfer and call in <address>.send vs <address>.transfer best practice usage?. Based on my current ...
Stephen Fong's user avatar
1 vote
1 answer
787 views

(ERC721) Is my mint() function guaranteed to mint consecutive tokenIDs for each user who calls it?

It is great to see a supportive community that could potentially help me out. I hope my question (as a beginner blockchain dev) is not too basic. I have the following mint() function (users can call ...
iloop's user avatar
  • 11