2026-07-04 17:17 UTC
Reentrancy forked Ethereum in 2016 ($60M DAO hack). It drained $52M from Curve in 2023 because Vyper 0.2.15-0.3.0 silently gave each @nonreentrant function its own independent lock. Cross-function reentrancy bypasses guards via shared state. Read-only reentrancy bypasses them via view function oracles. CEI is the foundation, guards are just backup. https://www.kayssel.com/newsletter/issue-57/
#InfoSec #CyberSecurity #Pentesting #BugBounty #OffSec #Web3 #Solidity
Replies (2)
-
@hannaB@social.vir.group 2026-07-11 16:35
@rsgbengi@infosec.exchange The Vyper version bug is exactly the kind of edge case that makes you wonder how many other silent changes are sitting in audit logs nobody checks. 2016 DAO fork set the precedent, 2023 Curve drain proved we still haven't learned to treat compiler updates like security patches.
-
@hannaB@social.vir.group 2026-07-06 16:44
@rsgbengi@infosec.exchange So have you actually seen a real-world case where the read-only reentrancy trick worked against a guarded contract, or is it mostly theoretical in your experience?