# Reentrancy in liquidation and flash actions

External callbacks (token/NFT hooks, flash receivers, routers) firing before collateral, debt or limit state is settled

_Area: DeFi oracles, liquidations and flash loans. Seen in 7 disclosed reports; latest 2024-01-29. Updated 2026-10-23._

## How it works
Liquidation and flash-loan paths must move value out and update accounting. When the outbound transfer or callback (ERC721/ERC1155 `safeTransferFrom`, ERC777 hook, flash-loan receiver, router call, royalty payout) runs *before* the contract writes the new collateral/debt/limit state, the receiver regains control while the books still show the old state. It re-enters the same or a related function and acts on stale accounting: borrowing against collateral it is about to withdraw, self-liquidating at a dust bid, or borrowing past a limit. The broken assumption is that the external call is the last thing that happens; in fact it hands execution to an attacker mid-transaction.

## Where it shows up
- State flags like `useAsCollateral` or debt balances written *after* a burn/transfer to the receiver [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-omni-protocol-july-2022.md).
- Flash-loan entrypoints that mint debt, then call the receiver's `onFlashLoan`/action target before the health or limit check [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-2.md)[E5](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-32.md).
- `liquidate()` forwarding user-supplied calldata to a router and validating only a token balance delta [E3](https://bugbountylibrary.com/r/c4%3A2022-04-mimo%3AH-01.md).
- Routers that refund surplus ETH based on `address(this).balance` after an external payout [E4](https://bugbountylibrary.com/r/c4%3A2023-04-caviar%3AM-09.md).
- Collateral rounded to zero below a `minUsdValue` threshold, read to decide "all sold" [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-2.md).

## How to review
The invariant: every state change that the callback could exploit (collateral flag, debt, borrow limit, auction settlement) must be committed before any external call, or the entrypoint must be `nonReentrant`. Check ordering in each function that transfers to a receiver; confirm guards exist on flash and liquidation entrypoints; confirm balance-delta checks cannot be satisfied by a reentrant deposit [E3](https://bugbountylibrary.com/r/c4%3A2022-04-mimo%3AH-01.md); confirm refunds use a pre-call snapshot, not live balance [E4](https://bugbountylibrary.com/r/c4%3A2023-04-caviar%3AM-09.md).

## Variants seen
- NFT burn-to-receiver reentering withdraw/liquidation [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-omni-protocol-july-2022.md).
- ERC777 callback during flashAction enabling self-liquidation and dust-bid write-off [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-2.md).
- Arbitrary router call reentering to inflate balance check [E3](https://bugbountylibrary.com/r/c4%3A2022-04-mimo%3AH-01.md).
- Royalty-recipient fallback reentering a router refund [E4](https://bugbountylibrary.com/r/c4%3A2023-04-caviar%3AM-09.md).
- Flash-loan receiver reentering to exceed borrow limit [E5](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-32.md).

## Impact and severity
Direct fund loss: $1.4M drained [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-omni-protocol-july-2022.md), pool drained via debt write-off [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-2.md), collateral stolen [E3](https://bugbountylibrary.com/r/c4%3A2022-04-mimo%3AH-01.md), router ETH swept [E4](https://bugbountylibrary.com/r/c4%3A2023-04-caviar%3AM-09.md), unlimited borrowing [E5](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-32.md). Severity is high; worse when no guard exists and the callback is attacker-controlled.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-omni-protocol-july-2022.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-2.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-04-mimo%3AH-01.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-04-caviar%3AM-09.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-32.md