Challenge 13

tx.origin Misuse

HighReentrancy

Challenge

Review the external call in withdraw. Can a recipient contract call back before its balance is cleared?

Starter code

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract ReentrancyIssue {
  mapping(address => uint) public balances;

  function deposit() public payable {
    balances[msg.sender] += msg.value;
  }

  function withdraw() public {
    uint amount = balances[msg.sender];
    require(amount > 0, "No balance to withdraw");
    (bool success, ) = payable(msg.sender).call{value: amount}("");
    require(success, "Transfer failed");
    balances[msg.sender] -= amount;
  }
}

Show hint

Consider checks-effects-interactions and a reentrancy guard.