reentrancy-attack
재진입 공격은 스마트 컨트랙트의 재귀 호출에 대한 취약점을 악용하여 공격자가 초기 트랜잭션이 완료되기 전에 자금을 반복적으로 인출하거나 컨트랙트 상태를 조작할 수 있도록 합니다.
재진입 공격은 악성 컨트랙트가 첫 번째 호출이 실행을 완료하기 전에 취약한 컨트랙트를 다시 호출할 때 발생합니다. 이 재귀 호출은 자금을 고갈시키거나 컨트랙트의 상태를 의도하지 않은 방식으로 변경할 수 있습니다. 취약점은 컨트랙트가 외부 호출, 특히 내부 상태를 잠재적으로 조작할 수 있는 호출을 제대로 고려하지 않을 때 발생합니다. 이는 사용자와 프로젝트에 상당한 재정적 손실을 초래할 수 있으므로 분산형 애플리케이션(dApp)에서 중요한 보안 문제입니다.
graph LR
Center["reentrancy-attack"]:::main
Pre_logic["logic"]:::pre --> Center
click Pre_logic "/terms/logic"
Rel_smart_contracts["smart-contracts"]:::related -.-> Center
click Rel_smart_contracts "/terms/smart-contracts"
Rel_smart_contract_vulnerability["smart-contract-vulnerability"]:::related -.-> Center
click Rel_smart_contract_vulnerability "/terms/smart-contract-vulnerability"
Rel_smart_contract_security["smart-contract-security"]:::related -.-> Center
click Rel_smart_contract_security "/terms/smart-contract-security"
classDef main fill:#7c3aed,stroke:#8b5cf6,stroke-width:2px,color:white,font-weight:bold,rx:5,ry:5;
classDef pre fill:#0f172a,stroke:#3b82f6,color:#94a3b8,rx:5,ry:5;
classDef child fill:#0f172a,stroke:#10b981,color:#94a3b8,rx:5,ry:5;
classDef related fill:#0f172a,stroke:#8b5cf6,stroke-dasharray: 5 5,color:#94a3b8,rx:5,ry:5;
linkStyle default stroke:#4b5563,stroke-width:2px;
🧠 지식 테스트
🧒 5살도 이해할 수 있게 설명
It's like going to an ATM, withdrawing money, but before the machine updates your balance, you quickly ask it again for money, and it lets you take more because it hasn't realized you already took some!
🤓 Expert Deep Dive
Reentrancy attacks exploit the asynchronous nature of external calls in smart contract execution environments. In Ethereum's EVM, when a contract sends Ether using call.value()(), the receiving contract's fallback function or receive function is executed. If this fallback logic contains a call back to the sending contract's vulnerable function (e.g., withdraw()), the execution stack allows this recursive call. The attacker's contract can manipulate the msg.sender context or internal state variables within the re-entered function call. The Checks-Effects-Interactions pattern is a fundamental security principle to prevent this; state changes must be finalized before external calls are made. For instance, updating the user's balance to zero before sending the Ether prevents the re-entered call from seeing a non-zero balance. Reentrancy guards, often implemented as a state variable toggled during function execution, act as a mutex to prevent re-entry. However, care must be taken to ensure the guard is correctly reset, especially in complex interaction chains.