Reentrancy Attack
An exploit where a contract is called back mid-execution, draining funds before its balances update.
A reentrancy attack hits contracts that send funds before updating their internal records. The attacker's contract receives the payment and immediately calls back into the vulnerable function, withdrawing again and again before the balance is set to zero. The loop repeats until the contract is empty.
This is the bug behind the 2016 DAO hack, which drained about 3.6 million ETH and forced the Ethereum hard fork that created Ethereum Classic. The standard defense is the checks-effects-interactions pattern—update state before sending funds—plus reentrancy guards that lock a function during execution.
Related terms
A 2016 exploit that drained millions from a flagship Ethereum project and forced a contentious hard fork.
Smart Contract AuditA structured review of contract code that hunts for vulnerabilities before attackers find and exploit them.
Smart ContractSelf-executing code on a blockchain that runs exactly as written when its conditions are met, with no party able to intervene.
Flash Loan AttackAn exploit using an uncollateralized loan repaid in one transaction to manipulate prices and drain a protocol.