# Contract callback reentrancy violates a state invariant

Nested calls observe or alter state under assumptions that do not hold while an earlier operation is incomplete.

**Candidate CWE:** [CWE-1265](https://cwe.mitre.org/data/definitions/1265.html)

## Test hypothesis

Use one bounded local callback attempt into the same or related function. Compare with an inert callback under identical balances and roles, then check an independent accounting or authorization invariant.

## Evidence required

External-call trace, intermediate state, nested transition, initial capital and measured entitlement or balance violation.

## Rule out false positives

A callback or missing guard alone is insufficient when state ordering and other controls preserve the property.

## Playbook and command references

- [Contract state: authorization, callbacks and accounting](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/smart-contract-state.html) — Turn protocol promises into explicit invariants and test realistic local operation sequences with independent accounting.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Contract%20state%3A%20authorization%2C%20callbacks%20and%20accounting)

## Referenced by these target playbooks

[Web3 & protocols](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/web3.html) · [OSS & self-hosted](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/oss.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the [mapping guide](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html).

## Primary references

- [CWE-1265: Unintended reentrant invocation](https://cwe.mitre.org/data/definitions/1265.html)
- [Solidity security considerations](https://docs.soliditylang.org/en/latest/security-considerations.html)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)