In this track: Smart contract security foundations
advanced · 4 MIN READ
Read-only reentrancy
A callback can exploit an inconsistent observation without writing through a view function.
LET’S PICTURE IT
A second office reads a balance while the first office has updated only half the ledger.
SEE IT FOR YOURSELF
A valid counter call, step by stepStep 1 / 4
This example begins with count zero and a request to call increment(). No real contract is deployed.
This example begins with count zero and a request to call increment(). No real contract is deployed.Execution follows the code’s input and permission rules. A website button is not the access-control mechanism.The function reads zero, calculates zero plus one, and writes one to persistent storage.The accepted state contains count one. Later reads can inspect it. Events are emitted only if the code implements them.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Locate the observation boundary
A contract may temporarily expose mismatched totals during an external interaction. A view function can read those totals without changing them.
Follow the dependent action
Another protocol can use that transiently inconsistent read to price or authorize an action. The harmful effect may occur elsewhere, outside the view function itself.
Keep public observations coherent
Review values exposed during callbacks and the order in which related fields change. A write lock does not automatically make all getters safe to consume.
Test a dependent reader
Use a local mock that queries the view during the handoff and attempts the downstream action. Assert the relevant invariant across both contracts.
Reason about the scenario
A partly updates reserves
A makes external call
callback reads A’s temporary ratio
B acts on that ratio
Pseudocode or a simplified scenario for local reasoning. This is not a production contract or a completed security review.
QUICK CHECK · NO PRESSURE
Does view status guarantee a returned value is safe for another protocol to use?
The observation can occur during an inconsistent transition.