Reentrancy is a recursive call issue where a malicious contract calls back the caller contract, before the first call is completed. If a state change is needed before making another external call, i.e. setting a value to zero, the state change may never happen due to recursive calls.

The recursive call continues until either the gas is exhausted or the call stack is full or the balance of the caller contract becomes zero.

SWC 107 Reentrancy

Remediation

• Make sure all internal state changes are performed before the call is executed. This is known as the Checks-Effects-Interactions pattern
• Use a reentrancy lock

For more detail guide, refer to DAO and recursive calls mini course on SecDim Learn.