Questions tagged [reentrant-attacks]

Questions related to "reentrancy vulnerability" or "reentrant attack", where untrusted code reenters a contract and manipulates state. http://forum.ethereum.org/discussion/1317/reentrant-contracts https://github.com/LeastAuthority/ethereum-analyses/blob/master/GasEcon.md

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

Solidity re-entrancy attacks and how to guard against them

I'm trying to understand re-entrancy attacks. Is tip1() below at risk of a re-entrancy attack (if the fallback function of the miner's contract invokes tip1() itself)? And if so, is tip2() safe? ...
0
votes
2answers
54 views

Slither Tool Error On Contract That Inherit From Openzeppeling

Hey Guys Hi ALl ! *I'm trying to use SLITHER (analizy tool ) but when i try to use it on a contract what inherit from Openzeppelin it give me this error(photo) Error: Source "@openzeppelin/...
0
votes
0answers
46 views

The transaction has been reverted to the initial state

I have been testing the script for reentrancy attack in remix, but every time I run it reverts the transaction. I did it in two different accounts, one for the etherstore's contract(deploying) and ...
0
votes
0answers
5 views

Have Numerous Store Contracts, Want to Push to Get Funds, What are the Risks

Basically I have many "storefront" contracts (they are personalized to a vendor) that collect Eth/tokens. Currently the way the vendor gets their payout (and I get my cut) is us calling a ...
0
votes
1answer
44 views

Reentrancy Attack -How to do it on this sell function? [closed]

Hey there guys how are u , can someone help me on this ? I want to do a REENTRANCY on this Dex , how can i change the code on sell function to stell ETH ,when somebody wanna sell theyr token throught ...
0
votes
0answers
68 views

Can safeTransfer cause reentrancy?

so I'm learning about reentrancy. I understand that external calls can result in reentrancy. Recently, I have started learning about Openzeppelin libraries, and got to know about safeERC20, which is a ...
1
vote
1answer
55 views

SMT Checker : Unexpected " BMC: Insufficient funds happens here"

I was using the SMT Solidity Model Checker, and I Don't understand why I have a :" BMC: Insufficient funds happens here". My code is quite simple, I just wanted to check if the Model Checker ...
3
votes
1answer
56 views

Executing reentrancy on Truffle Console: attacker not stealing 5 ether , why only 2 reentrant calls?

I am doing the example provided at: JustDev I have parameterized the withdraw method. Victim SC is: pragma solidity ^0.5.8; contract Victim{ address owner; constructor() public{ owner = ...
5
votes
1answer
149 views

Re-entrancy attack explanation and possible fix for specific NFT token - hashmasks

One popular recent NFT project - Hashmasks - Tweeted that some coder called 'samczsun' uncovered a possible re-entrancy attack in their mint function which would have allowed to mint more than the ...
1
vote
1answer
114 views

openzeppelin ReentrancyGuard Constructor

I am trying to use the openzeppelin ReentrancyGuard contract within my ERC721 Token smart contract. Since this ReentrancyGuard contract has a constructor, I am required to declare it in my contract. ...
1
vote
3answers
56 views

Do view functions cause reentrancy vulnerabulity?

It's well known that calling an external function before changing something in the contract causes a security problem called "reentrancy vulnerability". Does calling an external function ...
0
votes
0answers
26 views

Can't understand the problem with the code

I am reading the following tutorial. Tutorial What is the problem with the following code: function withdraw(uint amount) public { require(balances[msg.sender] >= amount); balances[msg....
0
votes
1answer
18 views

Denial of Service(DoS) and withdraw.pendingReturns[msg.sender]=0;

I am trying to understand the role of : withdraw.pendingReturns[msg.sender]=0; in detecting denial of Service (DoS) vulnerability. The following paper VeriSolid says that: withdraw.pendingReturns[...
1
vote
1answer
124 views

Reentrancy protection against multiple entries at once

I'm concerned about the security of the Reentrancy pattern that we can use in Solidity to prevent from calling multiple times a same function at the same time. This protection is nicely implemented ...
2
votes
0answers
95 views

Fail to Reproduce reentrancy in private chain but success in remix VM

I ran same victim and attack codes in remix VM, and private chain connected with metamask and remix. But, the attack successed in remix vm not in private. I inserted flag to mark which step is wrong, ...
0
votes
1answer
728 views

How should 'fallback' function be defined if we transact using 'call' method? [duplicate]

i came to know that 'call' method is better for transacting, since all gas is transferred and could withstand reentrancy attack.. but how should we define fallback function for 'call' method? using ...
1
vote
1answer
71 views

Different proxy code to upgrade smart contract and reentrancy attacks

I am trying to upgrade smart contract in ethereum. I found that proxy pattern can help me with this. In the openzeppelin docs, I should add the following code in fallback function in my contract: ...
0
votes
0answers
26 views

Please look over my contract for re-entrancy

I know the random number generator isn't secure and is susceptible to manipulation from miners and any advice on the method to generate random numbers will be appreciated. However, the reason I'm ...
4
votes
2answers
1k views

How does the re-entrancy guard modifier work?

Following is code for a re-entrancy guard, but not sure if I understand it properly: contract Test { using SafeMath for uint256; uint256 private counter = 1; modifier entrancyGuard() { ...
0
votes
1answer
57 views

Does reentrancy attack happens as soon as the balance in storage is modified after the withdrawal?

I just saw something like this: function sub( uint a, uint b ) internal pure returns (uint) { require(b <= a, "SUB_UNDERFLOW"); return a - b; } function withdraw(...
1
vote
1answer
30 views

Was throw part of DAO (attacked) code?

I have attached a picture related to DAO attack. I got the image from the following link A Survey on Ethereum Systems Security: Vulnerabilities, Attacks and Defenses . The image shows a code ...
1
vote
2answers
55 views

Is it possible to circumvent a require statement if the ordering of the requirements are incorrect?

Please take the following hypothetical code as an example mapping (address => uint256) public accountBalance; function deposit(uint256 amount) public { accountBalance[msg.sender] = ...
1
vote
1answer
125 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
1
vote
0answers
75 views

transfer(amount) failed even when it is not a contract

address payable receiver; receiver.transfer(amount); The receiver is NOT an contract, and the amount is only 0.4 ether, the contract is holding sufficient ether in its balance. I understood that ...
1
vote
1answer
137 views

Is it safe to do multiple payments in between locks (Reentrancy Guard)?

https://diligence.consensys.net/blog/2019/09/stop-using-soliditys-transfer-now/ provides a simple example related to using a Reentrancy Guard. Another approach to preventing reentrancy is to ...
0
votes
1answer
49 views

Is function like this one reentrant?

Got this in pseudo-code (Solidity like...) from audit of past work of person from our company, in short it seems to be withdrawing first and adding later. Maybe not a good idea, especially since it's ...
1
vote
1answer
429 views

How are transfer and send protecting against reentrancy if the gas is taken from the EOA (msg.sender)?

I guess transfer and send simply allow 2300 gas but no gas is taken from the contract? In other words if a wallet calls this function with say one million wei gas: function sending() public payable { ...
12
votes
2answers
4k views

Is transfer() still safe after the Istanbul update?

In other words, is using transfer() safe? function transfer(address contractB) public { contractB.transfer(1000); //balances[msg.sender] -= 1000; } How about using call.gas? function ...
0
votes
1answer
49 views

Transaction Timing Implications for Reentry Attacks

This is the classic reentry attack: function withdrawBalance() public { uint amountToWithdraw = userBalances[msg.sender]; (bool success, ) = msg.sender.call.value(amountToWithdraw)(""); ...
0
votes
1answer
23 views

Compliance and Violation patterns

I have downloaded the slides from the site: Compliance and Security patterns It says "No writes after calls." I can understand this concept. It’s a remedy for reentrancy problem. But it shows ...
2
votes
1answer
183 views

Reentrancy attack not working on mainnet, but working on ropsten and remix VM

I was fullfilling a reentrancy attack on a contract. I tested it in remix VM first and later on with deployed contract on ropsten testnet. Both worked well without any errors. On the mainnet it turned ...
0
votes
1answer
374 views

How does the reentrancy attack work?

Consider the following contracts contract Victim{ //... function donate() public payable { credit[msg.sender] += msg.value; } function withdraw(uint amount) public { if (credit[...
1
vote
0answers
24 views

How exactly theᴅᴀᴏ reentrancy hack was performed without having weiGiven>0 nor IsAllowed(WithdrawAddress)?

The well known ᴅᴀᴏ hack didn’t affect ether balances of theᴅᴀᴏ but balances of rewardAccount. That’s why I’m talking about the hack version which affected contract balances of theᴅᴀᴏ itself. With ...
0
votes
0answers
42 views

Revert() workflow in re-entrancy vulnerablity?

I am studying the following code contract Mutex { bool locked; modifier noReentrancy() { require(!locked); locked = true; _; locked = false; } function f(unit256 amount) public ...
0
votes
3answers
121 views

How do I attack the `Vuln` contract?

How can I steal from Vuln contract? I have made another contract to try to steal from Vuln but it always gives me an error. And I'm not sure how to send the money to my adrress. contract Vuln { ...
0
votes
0answers
30 views

Understand the `call` opcode in this contract

Hello, I am posting a quick question regarding the functionality this contract: https://etherscan.io/address/6b63ea3612dde97082aab468157950f927618d31#code From the source code, I am not even able to ...
0
votes
1answer
103 views

Is there any Reentrancy attack in given code snippet? If yes then how can I fix it?

function withdrawForeignTokens(address _tokenContract) onlyOwner IsAuthenticate public returns (bool) { ERC223Interface token = ERC223Interface(_tokenContract); return token.transfer(...
3
votes
1answer
52 views

Understand the trending of newly-uploaded smart contracts that is considered as vulnerable

We tried to use Oyente to analyze some online contracts and drawed a diagram regarding the potentially vulnerable smart contracts ("reentrancy" bug) with respect to their creation time. So the y-...
0
votes
1answer
40 views

Is a function prone to re-entrancy attack even if I set balance to zero within the same function (example included)

Such as in this scenario, is the hackable via re-entrancy? thanks... function withdraw(uint256 money) public { if(money <= balance[msg.sender]) { (bool success, ) = msg.sender.call....
0
votes
1answer
50 views

Constantinople gas change, reentrancy possibilities

With the new reduced fee for using SSTORE for 'dirty' storage slots, is it possible to re-enter a function from a send() or transfer() and have the contract call send() or transfer() again? Or is it ...
0
votes
2answers
272 views

Will 'x.send(amount)' revert if 'x' is a contract with a fallback function which reverts?

I know that x.transfer(amount) reverts if either one of the following two scenarios takes place: There is not enough ether in the calling contract, i.e., amount > address(this).balance Variable x ...
1
vote
1answer
85 views

Compiling error when using .value() for sending money between contracts using solidity and truffle framework

Dear fellow block builders! I am new to this field and I would like to implement my first project mimicking the famous DAO attack using re-entrance. I've programmed two smart contracts - the DAO and ...
1
vote
1answer
177 views

Can emitting an event after a state change cause a reentrancy attack vulnerability?

Is the following function vulnerable to a reentrancy attack? function withdraw() public { uint amount = pendingWithdrawals[msg.sender]; // Remember to zero the pending refund before // ...
1
vote
2answers
215 views

erc-721 erc-20 solidity code check effects interaction pattern

Where can one locate a formally verified ERC20/ERC721 solidity code/template that adheres to security design patterns such as check effects interaction patterns?
1
vote
1answer
248 views

Simulating DAO recursive/reentrancy attack

Trying to simulate the attack. In my attack contract: function attack() public { target.call(bytes4(keccak256("withdraw()")),amount); } function() payable public { if (msg.sender == ...
0
votes
1answer
27 views

Transaction Nonce deterring Re-entrancy Attack?

Why doesn't the use of transaction nonce deter re-entrancy attack?
0
votes
1answer
269 views

The constructor should be payable if you send value - contract sending ether to another contract throwing an error?

I'm trying to implement re-entrancy hack for my own contract. Here is a great article that explains the method: https://medium.com/@gus_tavo_guim/reentrancy-attack-on-smart-contracts-how-to-identify-...
0
votes
1answer
131 views

Potential re-entrancy vulnerability: how should I rearrange this function to avoid it?

I'm not ure why I keep getting a potential reentrancy attack vulnerability about the "publishEtherBox" function. The contract code is not complete but it should be enough to understand. Is it a bad ...
4
votes
2answers
4k views

What does msg.sender.call() do in Solidity?

Hi was going through solidity documentation. There was some code that I was not able to understand, even after researching a lot I was not able to find some satisfactory output. The code is as under: ...
1
vote
2answers
1k views

Checking Reentrancy Vulnerability in smart contracts

According to the Ethereum Smart Contract Best Practices, race conditions can occur across multiple functions, and even multiple contracts, any solution aimed at preventing reentry will not be ...