Lesson 14: Sublesson 'Reentrancy attacks' question

[0xpolarzero]

Hi there,

I'm following the Reentrancy vulnerabilities sublesson, and I have a question. In the repo, as well as in the Solidity by example page, the withdraw function is not payable. But it says the contract is vulnerable.

In the video, Patrick declares the withdraw function as payable so the attack can work. And if you take the code of the example (without it being payable), the attack function reverts.

Therefore, I'm wondering if the contract is still vulnerable to a reentrancy attack, is the withdraw function is not declared as payable ?

[alymurtazamemon]

@polar0 No we do not need payable with withdraw function because it is not using a global variable msg.value and the attack function needs a value of at least 1 ether in order to pass the revert statement, that could be the one reason why your attack function is reverting.

And our withdraw function is still vulnerable because we are changing the state at the end of it and because it uses external contract function calls that will call the fallback function of the attack contract that will again call the withdraw function and that loops go on until the balance will be greater than 0.

[0xpolarzero]

Ok, thanks for the answer.

I was wondering because I copy/pasted the code from these examples, and I can't use the attack function, even while passing a value of at least 1 Ether.

[alymurtazamemon]

@polar0 Yes it happened with you as well the call gets failed.