Reentrancy
A smart contract makes an external call that lets the callee call back in before the first call has finished updating state (OWASP Smart Contract Top 10 SC05, CWE-1265). Update state before external calls and guard every function that shares it.
- Defined in
- OWASP Smart Contract Top 10
Covered in
Guide
Test smart contracts through state invariants
Define the properties funds and privileges must preserve, then exercise callbacks, transaction sequences and exceptional conditions locally.
Guide
DeFi attack patterns: oracles, flash loans, proxies and signatures
The four smart-contract attack classes beyond reentrancy: price-oracle manipulation, flash-loan amplification, upgradeable-proxy storage collisions and uninitialized implementations, and signature replay, each with vulnerable and fixed Solidity, Foundry tests and verified incidents.