From 63c454a24897331605b27aefc8111d55d5ce83e0 Mon Sep 17 00:00:00 2001 From: "mia von steinkirch, phd" <1130416+mvonsteinkirch@users.noreply.github.com> Date: Fri, 23 Dec 2022 17:47:10 -0800 Subject: [PATCH] add list of reentrancy attacks by pcaversaccio --- .../README.md} | 30 +++++++++---------- 1 file changed, 14 insertions(+), 16 deletions(-) rename vulnerabilities/{reentrancy-notes.md => reentrancy_attacks/README.md} (64%) diff --git a/vulnerabilities/reentrancy-notes.md b/vulnerabilities/reentrancy_attacks/README.md similarity index 64% rename from vulnerabilities/reentrancy-notes.md rename to vulnerabilities/reentrancy_attacks/README.md index 1ee7ad5..843591c 100644 --- a/vulnerabilities/reentrancy-notes.md +++ b/vulnerabilities/reentrancy_attacks/README.md @@ -1,24 +1,22 @@ -## 🥛 reeentrancy +## reentrancy attacks -
+### tl; dr -### TL; DR - -* When a contract calls an external function, that external function may itself call the calling function. -* A reentrancy attack may occur when a function makes an external call to another untrusted contract. Then, the unstrusted contract makes a recursive callback to the vulnerable contract function to steal funds. -* To prevent this attack, a contract can implement a lock in storage that prevents re-entrant calls. +* when a contract calls an external function, that external function may itself call the calling function. +* a reentrancy attack may occur when a function makes an external call to another untrusted contract. Then, the unstrusted contract makes a recursive callback to the vulnerable contract function to steal funds. +* to prevent this attack, a contract can implement a lock in storage that prevents re-entrant calls.
--- -### Example of re-entrancy attack +### example
-For example, suppose this method: +for example, suppose this method: ``` function withdrawBalance() public { @@ -79,12 +77,12 @@ function withdrawBalance() public { ---- -### Resources +### resources -
- -* [Solidity docs](https://docs.soliditylang.org/en/latest/security-considerations.html#re-entrancy) -* [DASP](https://www.dasp.co/#item-1) -* [SWC](https://swcregistry.io/docs/SWC-107) -* [Not so smart contract](https://github.com/crytic/not-so-smart-contracts/tree/master/reentrancy) +* [reentrancy on solidity docs](https://docs.soliditylang.org/en/latest/security-considerations.html#re-entrancy) +* [reentrancy on DASP](https://www.dasp.co/#item-1) +* [reentrancy on SWC](https://swcregistry.io/docs/SWC-107) * [reentrancy patterns](https://github.com/uni-due-syssec/eth-reentrancy-attack-patterns) +* [list of reentrancy attacks by pcaversaccio](https://github.com/pcaversaccio/reentrancy-attacks) +* [reentrancy on not so smart contract](https://github.com/crytic/not-so-smart-contracts/tree/master/reentrancy) +