mediumConceptCodingMidSenior
Walk me through a re-entrancy attack, and how checks-effects-interactions prevents it
A reentrancy attack happens when a smart contract calls an untrusted address before updating its own state, letting the callee enter again and reuse stale balances. The checks-effects-interactions pattern closes that window by validating first, mutating state next and calling out last.
4 min readUpdated 2026-08-15
Answer
Short answer
A reentrancy attack exploits an external call made before state is corrected. Fix the function by doing checks first, applying effects such as balance updates second, and performing interactions last; add a reentrancy guard for cross-function cases that ordering alone cannot cover.
Was this answer helpful?
Likely follow-ups
- Why is relying on the 2300 gas stipend of transfer no longer considered a safe defence?
- How would a cross-function re-entrancy bypass a guard that only protects withdraw?
- What is read-only re-entrancy, and why does it endanger a contract that never sends value?
- How does a pull-payment or withdrawal-queue design remove the problem structurally rather than defending against it?
Related questions
- Why does storage layout dominate the gas cost of a contract?mediumAlso on evm and solidity5 min
- How does a proxy make a deployed contract upgradeable, and what does that put at risk?hardAlso on solidity and smart-contract-security5 min
- Assign n tasks to n workers at minimum cost, with n up to 20. Why a bitmask, and what does it cost?hardSame kind of round: coding4 min
- Find the cheapest flight from one city to another using at most K stops. Why does plain Dijkstra give the wrong answer?mediumSame kind of round: coding5 min