Reentrancy: the call that calls back

Graduate · enrolled learners

This lesson opens with SpankChain, October 2018.

What happened

SpankChain ran payment-channel smart contracts, and part of a channel operation made an external call to a token contract to move funds. Because that token could be any contract, an attacker supplied a malicious one, and when SpankChain's contract called into it, the malicious token's code called straight back into SpankChain's contract, before SpankChain had updated its own record of balances. On that stale state, the attacker's callback could withdraw again, and again, repeating the withdrawal against a balance the contract had not yet reduced, draining about 38,000 dollars in ether before it stopped. The attacker later returned the funds. Nothing broke cryptographically: the contract made an external call to untrusted code in the middle of an operation, before finishing its own bookkeeping, and the untrusted code used that opening to re-enter and act on the state as it was before the bookkeeping caught up. The order of operations, calling out before updating state, was the whole vulnerability.

The decision point

Reentrancy is when your contract makes an external call and the called code, before your contract has finished and updated its state, calls back into your contract and acts on that stale, not-yet-updated state, repeating an operation that should have happened once. SpankChain is the case: a channel operation called an attacker-supplied token contract before reducing its own recorded balance, so the token re-entered and withdrew repeatedly against the unchanged balance, draining about 38,000 dollars. This is the sharpest consequence of the prior lesson's point that an external call hands control to code you do not write: that code can call you back, and if it does so while your state is mid-update, it sees and exploits the inconsistency. The mental model is that an external call is not just fallible but a yield of control, a moment when someone else's code runs and can turn around and enter your contract again, so any state you have not finished updating before that call is state the callee can abuse. So the discipline is the checks-effects-interactions pattern: check the conditions, apply all effects to your own state (reduce the balance, mark the flag) first, and only then perform the external interaction, so that when control is handed out your state is already consistent and a reentrant call finds nothing to exploit; a reentrancy guard that blocks re-entry adds a second layer. SpankChain is what calling out before updating state does: it opens a window, hands an attacker the keys, and lets them walk through your contract as many times as the stale balance allows.

Recorded loss

$38,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.