state-sync-analysis

Read-only reentrancy occurs when a view function returns stale state during an external call callback. Trace functions that update state before making external calls, then check whether view functions like totalAssets() are consumed by external protocols during that window.

CEI stands for Checks-Effects-Interactions: validate inputs, update state, then make external calls last. Violating this order leaves state inconsistent during callbacks, enabling reentrancy exploits where attackers act on outdated values.

Flash loans let attackers manipulate pool reserves or oracle prices within a single transaction, call a vulnerable function that reads the manipulated state, then restore values before repaying the loan. The analysis models this as a timing attack scenario.

Yes, the framework maps cross-contract dependencies such as a vault reading an oracle price, and builds a state dependency graph showing risk paths where an attacker manipulates one contract to corrupt another's reads.

Static analysis identifies potential inconsistency windows but cannot confirm exploitability without considering runtime conditions like reentrancy guards, oracle update mechanisms, and access controls. Findings should be validated with proof-of-concept exploits.