Day 71 of #100DaysOfDeFI 🚀 looked at Re-Entrancy vulnerability🦹🏻 It is one of the most destructive attacks in the #Solidity smart contracts 💸 The untrusted contract that exploits the vulnerability is able to drain all user's funds 🚰
#100DaysOfCode
How it works 🧵
#100DaysOfCode
How it works 🧵
1/ To make it happen, there should be 2 contracts: a vulnerable contract and an attacker’s contract 👺
2/ The attacker should deposit some funds into the vulnerable contract 💰
3/ Then it calls the withdraw function to get its funds back ◀️
4/ The vulnerable contract sends the funds to the attacker and it triggers fallback function 👾
5/ Fallback calls the withdraw function again ♻️
6/ The vulnerable contract doesn’t manage to update the balances because it is stuck in a loop withdraw - fallback - withdraw 💸
7/ The malicious contract drains the funds of the vulnerable contract 🚰
8/ Vulnerable contract 👇
9/ Attacker contract 👇
10/ To prevent the reentrancy attack we should:
🔸 update balances before sending funds to any external contract;
🔸 use modifiers to prevent reentrancy.
🔸 update balances before sending funds to any external contract;
🔸 use modifiers to prevent reentrancy.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
