179: Reentrancy Attacks

 The nature of blockchain and the unique attributes of Solidity introduce a number of smart contract specific vulnerabilities. One of these exploits the block updating of Ethereum and is known as a reentrancy attack. This attack has been used in massive exploits stealing millions of dollars. The vulnerability stems from a smart contract calling an external contract which hosts malicious code. In this way, the reentrancy attack is similar to classic web vulnerabilities like cross site scripting. Once called, the malicious contract can now call the original contract again, "re-entering" it and even calling functions in unexpected ways. A simple contract that sends ether and then updates the balance can be exploited with this method, by repeatedly sending transfers of ether before the balance is updated. This can be mitigated by calculating all state changes before initiating any transfer of ether. These days, libraries like OpenZeppelin's ReentrancyGuard allow you to add the Nonreentrant modifier to your functions and protect against these exploits.