Contract callback reentrancy violates a state invariant
Nested calls observe or alter state under assumptions that do not hold while an earlier operation is incomplete.
Candidate CWE: CWE-1265
Test hypothesis#
Use one bounded local callback attempt into the same or related function. Compare with an inert callback under identical balances and roles, then check an independent accounting or authorization invariant.
Evidence required#
External-call trace, intermediate state, nested transition, initial capital and measured entitlement or balance violation.
Rule out false positives#
A callback or missing guard alone is insufficient when state ordering and other controls preserve the property.
Playbook and command references#
- Contract state: authorization, callbacks and accounting — Turn protocol promises into explicit invariants and test realistic local operation sequences with independent accounting.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the mapping guide.