# Reentrancy guard reset or bypass

Guard flag cleared mid-call, counter guard, or nested path that skips the lock

_Area: Smart contract access control and control flow. Seen in 15 disclosed reports; one confirmed bounty: $3,495; latest 2025-03-19. Updated 2026-10-22._

## How it works
A reentrancy guard is meant to hold one invariant: while a protected function is executing, no second entry into protected state changes can occur. The pattern breaks when the guard is not a strict lock. It may be a plain bool that another path (receive/fallback, helper, hook) also writes, so an external call resets it to unlocked mid-execution [E2](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-01.md). It may be a counter that increments and decrements instead of asserting zero, so nested entry passes [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-7.md). It may be turned off before a callee that is supposed to turn it back on, leaving a window [E6](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.9.md). Or the lock may be absent on a path that sweeps funds [E8](https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-07.md).

## Where it shows up
- A bool guard set true then false around an external call, with any other function (receive, fallback, internal helper) writing the same flag [E2](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-01.md).
- Counter-based guards (`_guardEntries++/--`) that never assert the count is zero on entry [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-7.md).
- `turnOffReentrancyProtection()` before a call whose callee re-enables it, with hooks or token callbacks in between [E6](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.9.md).
- Multicall/execute paths that unwrap and send the contract's whole balance to `msg.sender` with no guard, reachable via ERC777/ERC677 callbacks [E8](https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-07.md).
- Pre-check snapshots compared in a post-check, where a reentrant pre-check overwrites the snapshot [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-7.md).

## How to review
Identify every writer of the guard variable, not just the modifier. The property that must hold: between lock acquisition and release, no code path can set the guard to unlocked or increment past the check. Verify the guard asserts a strict state (count == 0) rather than tolerating nesting [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-7.md). For disable/re-enable flows, enumerate every external call and hook between disable and re-enable [E6](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.9.md). Check that solvency/health checks run after all external calls [E2](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-01.md). Confirm sweep-to-sender steps are guarded [E8](https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-07.md).

## Variants seen
- receive() resets the bool guard during a guarded ETH send [E2](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-01.md).
- Counter guard allows nested execTransaction to overwrite the module snapshot [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-7.md).
- Protection disabled before repay, hooks re-enter liquidation [E6](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.9.md).
- Unguarded multicall sweep drained via token callback [E8](https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-07.md).

## Why fixes fail
A blanket `nonReentrant` on the callback function can break legitimate reentrancy the flow depends on, causing all withdrawals to revert and funds to stick [E7](https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-03.md).

## Impact and severity
Fund theft via double-liquidation or balance sweep [E2](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-01.md)[E6](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.9.md)[E8](https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-07.md), and governance takeover by adding malicious modules [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-7.md). Severity rises when health checks run before external calls and when callbacks are attacker-controlled.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A2078581.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-23.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-7.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AH-02.md
- E6: https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.9.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-03.md
- E8: https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-07.md