AnalysisAU-2026-0261
Reentrancy is back, through token callbacks
The classic pattern was closed. Hook-bearing token standards reopened it sideways.
SeverityCritical
6 minSmart Contract Audits
Standards that notify the recipient on transfer hand control to untrusted code in the middle of a state change. The defence is the same as it always was — update state before the external call — and the mistake is easier to make because the call is not visible in the calling contract.
Reviewers who grep for external calls miss it. Reviewers who model control flow do not.