What Is the Defense against a Read-Only Reentrancy Attack?

The primary defense against a read-only reentrancy attack is to ensure that all state-reading operations within a function are performed only after all state-writing operations (the Effects step of CEI) are complete, or by using a reentrancy guard. More specifically, developers must be careful about external calls that might trigger a re-entrant read of a variable that is meant to be updated in the current transaction.

In essence, the CEI pattern must be strictly applied, and external calls should be isolated from critical state-reading logic.