Token hook reentrancy

A token interaction may invoke additional code.

LET’S PICTURE IT

Handing over a parcel can trigger the recipient’s own service workflow.

SEE IT FOR YOURSELF

A valid counter call, step by stepStep 1 / 4

This example begins with count zero and a request to call increment(). No real contract is deployed.

Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.

Know the asset behavior

Some token standards and implementations invoke sender or receiver hooks. Other token actions can also call external code through implementation-specific logic.

Treat transfer as an interaction

Do not assume a token transfer is a pure balance edit with no callback. Review the supported asset’s actual behavior and every reachable reentry path.

Protect shared state

A hook can enter a different function or another dependent protocol. Preserve invariants across the full interaction graph rather than one token wrapper alone.

Test a hooked local asset

Use a mock token or receiver that performs the relevant callback. Assert correct accounting and authorization before, during and after the transfer path.

Work through the boundary

application → token interaction
token / receiver hook → application callback path
review unfinished shared state

A simplified local review scenario. The example establishes a question to test, not a guarantee of production safety.

QUICK CHECK · NO PRESSURE

Can token-related callbacks affect a function outside the original transfer path?

Your progress stays in this browser.

Keep exploring the original referenceSolidity documentation ↗

Original explanations by EtherTools. Examples are educational and source-linked; this site is independent of the Ethereum Foundation. Our approach.