What Specific Code Vulnerability in the DAO Contract Allowed the Reentrancy?
The vulnerability was in the DAO's splitDAO function, which was used to withdraw funds. The code first checked the user's balance, then performed an external call to send the user their Ether ( msg.sender.call.value() ), and only after that did it update the internal ledger to reflect the withdrawal.
This violated the Checks-Effects-Interactions pattern. By making the external call before updating the state, it opened the door for the attacker to recursively call the function and withdraw the same funds repeatedly before the balance was set to zero.
Glossar
Code Vulnerability
Flaw ⎊ Code Vulnerability represents a specific weakness or unintended behavior within the smart contract source code that can be exploited by an external actor to cause unintended state changes or financial loss.
Code
Algorithm ⎊ Code, within cryptocurrency, options trading, and financial derivatives, represents a defined set of instructions enabling automated execution of trading strategies or complex calculations related to pricing and risk assessment.
Vulnerable Code
Concept ⎊ This term identifies segments of smart contract or exchange software logic that contain exploitable weaknesses, such as reentrancy bugs or improper access controls, which could compromise derivative positions or collateral.
Vulnerability
Exposure ⎊ Vulnerability within cryptocurrency, options, and derivatives manifests as quantifiable risk to capital stemming from imperfectly hedged positions or systemic dependencies.