Reentrancy Attack.

A smart-contract exploit where an external call lets the attacker re-enter the calling function before its state is updated, draining funds in a recursive loop. It belongs to the Web3 & Blockchain category of cybersecurity.

A smart-contract exploit where an external call lets the attacker re-enter the calling function before its state is updated, draining funds in a recursive loop.

Reentrancy happens when a contract sends ETH or tokens to an external address (often via call, transfer, or an ERC-777 hook) before it has updated its own internal accounting. The attacker controls that external address and uses the callback to invoke the original withdrawal function again, repeating the cycle until the contract is drained. Variants include single-function, cross-function, cross-contract, and read-only reentrancy. Mitigations include the checks-effects-interactions pattern, OpenZeppelin's ReentrancyGuard, pull-payment designs, and avoiding low-level calls to untrusted contracts. The 2016 attack on The DAO is the canonical example and led to the Ethereum/Ethereum Classic hard fork.

Defences for Reentrancy Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Recursive call attack.