Reentrancy Attack
A classic smart-contract exploit where a malicious contract repeatedly re-enters a function before it finishes updating.
A reentrancy attack exploits contracts that send funds before updating their internal balances. The attacker’s contract, on receiving funds, immediately calls back into the vulnerable function before it has recorded the withdrawal — repeating the loop to drain far more than it should. The 2016 DAO hack, which drained ~$60M and led to Ethereum’s contentious fork, was the seminal example.
It remains one of the most important vulnerability classes, which is why the “checks-effects-interactions” pattern (update state before sending funds) is drilled into every Solidity developer, and why audits hunt for it specifically. For users, reentrancy is a reminder that DeFi’s risks are often in subtle code logic, invisible from the interface.