Reentrancy vulnerabilities in disclosed bug bounty reports

Reentrancy is the oldest bug class in smart contract security and it keeps paying out because the shape of it changes faster than the mitigations do. The core mechanic never moves: a contract hands control to an untrusted address before it has finished writing its own state, and the callee re-enters through a second entrypoint that still reads the stale value.

The modern variants are what make it interesting. Cross-function reentrancy re-enters a different method that shares storage. Cross-contract reentrancy routes through a sibling contract in the same system. Read-only reentrancy never writes anything at all — it simply calls a view function mid-callback and hands a corrupted price or share value to an integrating protocol, which is why the largest recent payouts in this class landed on lending markets and vault wrappers rather than on the vulnerable contract itself.

The disclosures collected here span ERC-777 and ERC-721 callback hooks, native transfer callbacks, and Cosmos and Solana equivalents where reentrancy shows up as unfinalized account state rather than a callback.