Glossary
Read-Only Reentrancy
A reentrancy variant where an attacker re-enters a protocol during a state-inconsistent window and exploits a view function returning stale data, even though no state-changing function is reentered.
Read-only reentrancy exploits view (read-only) functions that
return stale data while another operation is mid-execution. Classic
nonReentrant guards protect state-changing functions but leave
getters unprotected, so an attacker can trigger a callback during an
operation — such as removing liquidity from a Curve-style pool — and
from within that callback call a price or share getter that reads
half-updated state. Downstream protocols that trust that getter, like
lending markets and vaults, can then be mispriced and drained.
A wave of 2022 incidents against Curve-integrated lending markets highlighted the class. Defenses include extending the reentrancy lock to cover view functions, or checking the pool's lock status before reading a reported value.