# Reentrancy before state update

External call, transfer, mint or callback before balance, debt or ownership write, with no guard

_Area: Smart contract access control and control flow. Seen in 102 disclosed reports; one confirmed bounty: $25,000; latest 2026-09-11. Updated 2026-10-23._

## How it works
A function hands control to an outside party — a token transfer, an NFT `_safeMint`/`safeTransferFrom` callback, an arbitrary `target.call`, or a native-ETH payout to `msg.sender` — and only afterward writes shared accounting (balances, debt, ownership, status flags, command markers). The assumption that breaks is that control returns unchanged. The callee re-enters the same or a sibling function while state is still stale, so the reentrant call reads or writes accounting the outer call has not committed. The outer call then finishes on top of the corrupted state.

## Where it shows up
- Caller-supplied token, collateral, or `target` address invoked before debt/balance writes [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AH-1.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-3.md).
- `_safeMint`/`safeTransferFrom`/`onERC1155Received` firing mid-function, state written after [E4](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-03.md)[E7](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-06.md).
- Native-ETH refund or payout to `msg.sender` before the swap, burn, or `lpInfo` decrement completes [E1](https://bugbountylibrary.com/r/dhl%3A20260911-orb.md)[E6](https://bugbountylibrary.com/r/dhl%3A20260527-joeagent.md).
- Sibling functions (`modifyOrder`, `cancelAuction`, `repayLeverage`) mutating the same accounting without the guard the entry function has [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AH-1.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-3.md).
- Payout before the executed-command marker is recorded [E5](https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AH-01.md).
- Whitelist/tax-skip status on the calling contract widens the surface: transfers skip tax, so re-entry is cheaper [E1](https://bugbountylibrary.com/r/dhl%3A20260911-orb.md).

## How to review
For every external call, transfer, mint, or callback, list each state variable written after it and each entrypoint that reads those variables. The invariant: no externally reachable function may observe or mutate accounting an in-flight call has not yet committed. Checklist:
- Are all effects before the interaction (CEI)? CEI alone fails when a callback mutates state read later — verify the read-after-call values cannot change [E7](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-06.md).
- Does a `nonReentrant` guard cover every externally reachable sibling touching the same state, and the callback path, not just the entry function? [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AH-1.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-3.md)
- Is accounting per-position, not an aggregate `balance >= X` check? A stale per-user `lpAmount` still passes an aggregate check [E6](https://bugbountylibrary.com/r/dhl%3A20260527-joeagent.md).
- Is the command/rental/order marker set before any transfer or callback? [E4](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-03.md)[E5](https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AH-01.md)
- Does any post-transfer check use a ratio or price that the reentrant call itself moves, lowering the amount required? [E6](https://bugbountylibrary.com/r/dhl%3A20260527-joeagent.md)
- Is the callee contract validated, or can an attacker-supplied address re-enter a separate buy/sell path? [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AH-1.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-3.md)

## Variants seen
- Refund-before-sell re-entry in a whitelisted pool contract [E1](https://bugbountylibrary.com/r/dhl%3A20260911-orb.md).
- Malicious collateral token re-enters to zero `leverageDebt` [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AH-1.md).
- Arbitrary `target.call` re-enters `modifyOrder` to move and cancel funds [E3](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-3.md).
- ERC1155 receiver hook moves rented NFTs before rental registration [E4](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-03.md).
- Recipient re-enters `execute` before `commandId` is recorded [E5](https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AH-01.md).
- Native payout before `lpInfo` decrement drains shared pool [E6](https://bugbountylibrary.com/r/dhl%3A20260527-joeagent.md).
- ERC721 callback shrinks bond before `createWithToken` reads it [E7](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-06.md).

## Impact and severity
High: theft of LP/vault/bridge funds [E1](https://bugbountylibrary.com/r/dhl%3A20260911-orb.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AH-1.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-3.md)[E5](https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AH-01.md)[E6](https://bugbountylibrary.com/r/dhl%3A20260527-joeagent.md)[E7](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-06.md), price crash [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AH-1.md). Worse when guards are missing on siblings, accounting is aggregate rather than per-position, or the re-entry mutates the counterparty/authorization the outer call relies on [E4](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-03.md)[E7](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-06.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260911-orb.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AH-1.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-3.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-03.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AH-01.md
- E6: https://bugbountylibrary.com/r/dhl%3A20260527-joeagent.md
- E7: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-06.md
- E8: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.7.md