What Is Reentrancy?
Reentrancy occurs when a contract is called back during an external call, exploiting an incomplete state before internal records are updated.
On this page
How Does a Reentrancy Vulnerability Work?
Reentrancy is a security issue that can arise when a smart contract’s external call triggers a re-entry into the same execution flow. In Turkish, it is described as “yeniden giriş.” If a contract hands over control to another contract before completing its own records, the counterparty can exploit this partially updated state.
Not every re-entry is an attack. The problem occurs when the re-entry disrupts the intended sequence of operations, leading to unauthorized outcomes. The key factors are which functions can call each other and when shared records are updated.
A Simple Withdrawal Example
Imagine a contract that first sends funds to a user and then resets the user’s internal balance to zero. The recipient contract can call the original contract again the moment it receives the funds. Since the internal balance hasn’t been zeroed out yet, the system may perceive the second withdrawal as valid. If this process is repeated within the same chain of calls, more funds than intended can be paid out.
This example illustrates the logic of the issue; actual vulnerabilities can also occur across different functions or even across different contracts. Looking only at a single withdrawal function may not reveal the full extent of the risk.
How Is It Prevented, and What Should Users Know?
Developers implement methods such as updating records before making external calls, using reentrancy guards (locks), and auditing cross-function effects. However, the presence of a security tool does not guarantee that the entire design is correct. Where and how the protection is applied is what matters.
For a user, the phrase “reentrancy protected” is not a security certificate on its own. One should examine which code version the audit report covers and whether changes were made afterward. These types of vulnerabilities can affect the collective funds held by the application beyond just the individual signer; simply disconnecting a wallet does not remove previously deposited assets from the contract.