ERC-777/1155/721 hook without reentrancy guard
A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor detects whether the protocol accepts tokens that implement callback hooks -- specifically ERC-777 (tokensReceived via ERC-1820), ERC-1155 (onERC1155Received), or ERC-721 (onERC721Received) -- without applying reentrancy guards to the functions in the protocol that receive or process those tokens. The assessment checks the protocol's supported token list against the set of functions that handle incoming token transfers and verifies guard coverage.
Why it matters
Non-standard token callbacks invoke external code during a token transfer, before the calling protocol can update its accounting state. Cream Finance ($18.8M, 2021) accepted AMP -- an ERC-777-based ERC-1820 token -- in its borrow() function, which had no reentrancy guard. The attacker exploited the tokensReceived callback to re-enter borrow() before Cream's borrow balance was updated, borrowing multiple times against the same collateral. Revest Finance lost funds via an ERC-1155 onERC1155Received callback; Sovryn via a callTokensToSend hook; Orion Protocol via a fake token transfer hook in its aggregator swap path. The pattern is consistent across four hacks in the dataset.
Green / Yellow / Red
Green: the protocol either does not accept ERC-777 / ERC-1155 / callback-hook tokens, or all functions that receive such tokens carry nonReentrant guards verified by static analysis. Yellow: callback-hook tokens are accepted but reentrancy guards are present on primary fund-moving functions only, with some peripheral functions (reward claims, yield compounders) unguarded. Red: any core fund-moving function accepts a callback-hook token without a reentrancy guard.
Common gray cases
This factor is gray when the protocol's accepted token list is not publicly defined or when the token's callback behavior cannot be confirmed without running the token contract's code.
Notable historical examples
No hacks are currently linked in the database for this specific factor, though Cream Finance (ERC-777 reentrancy), Revest Finance (ERC-1155 callback), and Orion Protocol (fake token hook) are the primary documented cases in the broader cross-hack dataset.
Measurement what to look for#
Determine whether the protocol integrates token standards with callbacks (ERC-777 tokensReceived, ERC-1155 onReceived, ERC-721 onReceived) without reentrancy guards on the affected functions.