Reentrancy

// VULNERABLE: State updated after external call
function withdraw(uint256 amount) public {
    require(balances[msg.sender] >= amount);

    // External call BEFORE state update
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success);

    // State update happens too late
    balances[msg.sender] -= amount;
}

contract Attacker {
    Bank public bank;

    constructor(address _bankAddress) {
        bank = Bank(_bankAddress);
    }

    receive() external payable {
        if (address(bank).balance >= 10 ether) {
            bank.withdraw(10 ether);  // Re-enter!
        }
    }

    function attack() public payable {
        bank.deposit{value: 10 ether}();
        bank.withdraw(10 ether);
    }
}

// SAFE: State updated BEFORE external call
function withdraw(uint256 amount) public {
    require(balances[msg.sender] >= amount);

    // Update state FIRST
    balances[msg.sender] -= amount;

    // External call LAST
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success);
}

// SAFE: Mutex lock prevents re-entry
bool private locked;

modifier noReentrant() {
    require(!locked, "Reentrant call");
    locked = true;
    _;
    locked = false;
}

function withdraw(uint256 amount) public noReentrant {
    require(balances[msg.sender] >= amount);
    balances[msg.sender] -= amount;
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success);
}

{
  "issues": [
    {
      "tag": "reentrancy",
      "severity": "high",
      "description": "External call before state update in withdraw()",
      "location": "withdraw(uint256)",
      "variant": "single-function"
    }
  ]
}