Curriculum·G202 Vulnerability Classes a User Must Understand·about 31 min
Reentrancy, and the order of operations
By the end of this lesson you can
- →Explain reentrancy as a contract being called again before it finishes updating its own state
- →State how The DAO's withdraw function sent funds before zeroing the balance, and why that let one call repeat
- →Compute how a recursive withdrawal drains a balance the internal accounting still shows as full
- →Recognize the checks-effects-interactions pattern and read whether a protocol violated it
Graduate · enrolled learners
This lesson opens with The DAO, 17 June 2016.
- What happened
- The DAO was an Ethereum investment fund holding about 11.5 million ETH of contributors' money. Its exit path, the split function, did two things in the wrong order: it paid the caller out first, and updated the caller's internal balance to zero second. Sending ETH to a contract can trigger that contract's code, so an attacker's contract, on receiving the ETH, called the withdrawal function again before the balance update ran. The balance still showed the full amount, so the second call sent the ETH again, and the attacker looped this recursively, draining about 3.6 million ETH, around a third of the fund, valued at the time at around 50 million dollars. The drained ETH sat in a child DAO under a 28-day holding period, and the Ethereum community hard-forked the chain on 20 July 2016 to restore it, creating the split between Ethereum and Ethereum Classic.
- The decision point
- The DAO's invariant was that a contributor can withdraw only what they hold. It was enforced by an internal balance that the withdrawal function updated, but the function updated it after sending the funds, and sending funds handed control to the recipient. In that gap, control belonged to the attacker while the balance still said full, and the attacker used the gap to call again. This is reentrancy: a function interrupted between acting and recording, reentered before the record catches up. It is one of the oldest and most recurrent classes, and the fix is an ordering discipline, do the checks, make the state changes, then interact with the outside, that a user can look for and an attacker looks for the absence of.
- Recorded loss
- $50,000,000
What you will be able to answer
- →What is reentrancy?
- →What did The DAO do wrong?
- →The checks-effects-interactions pattern?
- →Does reentrancy still happen?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://chain.link/article/what-is-reentrancy-attack
- https://en.wikipedia.org/wiki/The_DAO
- https://blog.ethereum.org/2016/06/17/critical-update-re-dao-vulnerability
- https://web.archive.org/web/20240302170908/https://certik.medium.com/fei-protocol-incident-analysis-8527440696cc
- https://www.halborn.com/blog/post/explained-the-dforce-hack-february-2023
Confidence high·Volatility low·Reviewed 2026-09-14·Owner unassigned
Contested
The DAO loss is 3.6 million ETH, around a third of the 11.5 million ETH committed to it. Wikipedia values it at around 50 million dollars at the time, and dollar figures for it vary with the ether price used, so the ETH figure is the load-bearing one. The Ethereum Foundation's post of 17 June 2016 confirms the date and describes a recursive calling vulnerability. Vitalik Buterin's post describes the exploit as a recursive call into the split function. The 2022 Rari Fuse hack is a classic write reentrancy, per CertiK's analysis; the read-only variant is illustrated by the February 2023 dForce hack, per Halborn, and the attacker returned those funds.
This lesson teaches reentrancy as a class a user recognizes, not how to write a guard. The developer treatment is the explicit handoff to Cyfrin Updraft named in the track note.