DeFi Security · Vulnerability class

Reentrancy

A contract calls out to another contract before it has finished updating its own books, and the callee calls back in to claim again.

Database Incidents Chains Protocols Vulnerabilities

The concept

The order of steps matters. If a balance is updated after an external call, the callee can act on stale state. The fix is to finish updating state first, and to limit what an untrusted callee can do.

Defensive lessons

Update balances before making external calls.
Add reentrancy guards on functions that move value.
Treat any caller-chosen contract as hostile.

Stored incidents

2026-09-07 · reported loss $255K (124,500,000 HEMI)
Hemi Genesis Drop: reentrancy in the MerkleBox claim contract
Official statement