Reentrancy, and the order of operations

Graduate · enrolled learners

This lesson opens with The DAO, 17 June 2016.

What happened

The DAO was an Ethereum investment fund holding about 3.6 million ETH of contributors' money. Its withdrawal path did two things in the wrong order: it sent the caller their ETH first, and updated the caller's internal balance to zero second. Sending ETH to a contract can trigger that contract's code, so an attacker's contract, on receiving the ETH, called the withdrawal function again before the balance update ran. The balance still showed the full amount, so the second call sent the ETH again, and the attacker looped this recursively, draining about 3.6 million ETH, worth roughly 60 million dollars at the time. The severity of the loss led the Ethereum community to hard-fork the chain to reverse it, creating the split between Ethereum and Ethereum Classic.

The decision point

The DAO's invariant was that a contributor can withdraw only what they hold. It was enforced by an internal balance that the withdrawal function updated, but the function updated it after sending the funds, and sending funds handed control to the recipient. In that gap, control belonged to the attacker while the balance still said full, and the attacker used the gap to call again. This is reentrancy: a function interrupted between acting and recording, reentered before the record catches up. It is one of the oldest and most recurrent classes, and the fix is an ordering discipline, do the checks, make the state changes, then interact with the outside, that a user can look for and an attacker looks for the absence of.

Recorded loss

$60,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.