skills.rest
BitterSecurity
BitterSecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

reentrancy

Detects reentrancy vulnerabilities in Solidity smart contracts using CEI violation and callback patterns.

66|17|Updated Jan 21, 2026
Search Tags:#vulnerability detection#solidity#reentrancy#defi#smart contract audit#web3 security#cei pattern
One-click install
npx skills add https://github.com/BitterSecurity/Vigilo --skill reentrancy-bittersecurity
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reentrancy
Source: https://github.com/BitterSecurity/Vigilo/tree/main/packages/claude/skills/vulnerability-patterns/reentrancy
Command: npx skills add https://github.com/BitterSecurity/Vigilo --skill reentrancy-bittersecurity

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Smart contract auditors need systematic detection patterns to find reentrancy vulnerabilities—CEI violations, cross-function and cross-contract reentrancy, read-only reentrancy, and token callback exploits—before attackers exploit them. ## Core Features & Use Cases - Five Detection Patterns: Covers classic CEI violations, cross-function reentrancy, cross-contract reentrancy, read-only reentrancy, and token callback exploits (ERC721/777/1155/1363). - State Timeline Artifact: Requires every finding to document a step-by-step state timeline showing stale balances during callback windows. - Search Query Reference: Provides ready-to-use Grep queries for locating external calls, callbacks, reentrancy guards, and view functions in Solidity codebases. - Use Case: During a Phase 2 audit of a vault contract, an auditor uses the cross-contract reentrancy pattern to discover that a lending contract reads stale share balances during a withdraw callback, enabling undercollateralized borrows. ## Quick Start Audit this Solidity codebase for reentrancy vulnerabilities using the detection patterns and state timeline methodology.

Frequently Asked Questions about reentrancy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect reentrancy vulnerabilities in Solidity contracts?▼

Identify external calls like .call{value}, transfer, and safeTransferFrom, then verify state is updated before the call following the Checks-Effects-Interactions pattern. Check whether callbacks can re-enter the function or reach other functions sharing the same state.

What is read-only reentrancy in smart contracts?▼

Read-only reentrancy occurs when a view function returns stale state during an external call callback, and external protocols make decisions based on that wrong value. The dForce exploit lost $3.7M this way when a stale Curve pool price was used for collateral valuation.

Does ReentrancyGuard protect against all reentrancy attacks?▼

No. A standard ReentrancyGuard only protects functions within a single contract. Cross-function reentrancy bypasses guards on unguarded functions sharing state, and cross-contract reentrancy bypasses guards entirely when other contracts read stale state.

Which token standards have callback hooks that enable reentrancy?▼

ERC721 triggers onERC721Received via safeTransferFrom, ERC777 has tokensReceived and tokensToSend hooks, ERC1155 triggers onERC1155Received, and ERC1363 has onTransferReceived. Any of these can hand execution control to attacker code mid-transaction.

Why does SafeERC20 not prevent reentrancy attacks?▼

SafeERC20 only handles inconsistent return values from token transfers; it does not prevent callbacks. Tokens implementing ERC777 hooks still execute attacker-controlled code during transfers regardless of the SafeERC20 wrapper.

Related Skills

Explore More Software Engineering Skills→
dajneem23dajneem23

reentrancy-pattern-analysis

Detect reentrancy vulnerability variants in smart contracts via call graphs and CEI compliance.

Community
Advanced
PurpleAILABPurpleAILAB
60

reentrancy

Detect reentrancy vulnerabilities in Solidity smart contracts and generate State Timeline maps.

Official
Advanced
pdparchitectpdparchitect
13

web3-audit

Audit Solidity and Rust smart contracts for common vulnerability classes.

Community
Advanced
rajyeole6rajyeole6

agency-blockchain-security-auditor

Audit smart contracts for reentrancy, oracle manipulation, and access control vulnerabilities.

Community
Advanced