Skip to content
attack.paths
Iniciar sesión
← RegistryDossier · 6 steps · 5 edges

Reentrancy → drain vault contract

Vulnerable withdraw() sends ETH before updating balance. Attacker contract re-enters via fallback() until the vault is empty — the canonical DAO-2016 pattern.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: Solidity contract pre-0.8 (or with explicit unchecked arithmetic / external call before state update). No nonReentrant modifier. Attacker can deploy a contract that interacts with the target.

§ Steps

  1. 01
    Vault balance drainedExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Initial deposit to be eligibleInitial Access
    T1078— Valid Accounts
  3. 03
    Deploy attacker contractInitial Access
    T1078— Valid Accounts
  4. 04
    Static audit (Slither / Mythril)Reconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  5. 05
    withdraw() → fallback re-entersImpact
    W3-REENTRANCY— Reentrancy Attack
  6. 06
    Spot call-before-effect patternImpact
    W3-REENTRANCY— Reentrancy Attack

§ References

§ Frequently asked

What is the "Reentrancy → drain vault contract" attack path?
Vulnerable withdraw() sends ETH before updating balance. Attacker contract re-enters via fallback() until the vault is empty — the canonical DAO-2016 pattern. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Vault balance drained (T1041) — a exfiltration primitive. Assumed environment: Solidity contract pre-0.
What is the final impact of this kill-chain?
The final step lands on Spot call-before-effect pattern (W3-REENTRANCY), which falls under Impact. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers