DAO Reentrancy Benchmark

Background

The DAO exploit is one of the most famous smart contract attacks in Ethereum history. The vulnerability occurs when a contract sends ETH to an external address before updating internal accounting state. This allows a malicious contract to repeatedly re-enter the vulnerable function and drain funds.

For this benchmark, we created a minimal vulnerable contract reproducing the same vulnerability pattern and submitted it to AuditAgents without manual hints or modifications.

Vulnerability Tested

The following function reproduces the reentrancy vulnerability class from the DAO exploit:

                        Solidity
                        Vulnerable
                    

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract VulnerableDAO {
    mapping(address => uint256) public credit;

    function deposit() external payable {
        credit[msg.sender] += msg.value;
    }

    function withdraw(uint256 amount) public {
        require(credit[msg.sender] >= amount);

        // ⚠ ETH sent before state update — reentrancy window opens here
        (bool success,) = msg.sender.call{value: amount}("");
        require(success);

        // State updated AFTER the external call — too late
        credit[msg.sender] -= amount;
    }

    receive() external payable {}
}

Exploit: The external ETH transfer occurs before updating the user's balance, enabling recursive re-entry attacks. A malicious contract's receive() function can call withdraw() again before credit[msg.sender] is decremented, draining the contract.

AuditAgents Findings

The following issues were identified by AuditAgents without any hints or prior knowledge of the vulnerability:

Critical Reentrancy Attack Vector

Medium Unchecked External Call Gas Limits

Low Absence of Event Emissions

Info Missing Access Controls

Benchmark Evaluation

Expected Detection	AuditAgents Result
Reentrancy Vulnerability	✓ PASS
CEI Pattern Violation	✓ PASS
Fund Drain Scenario	✓ PASS
DAO Exploit Similarity	✓ PASS
Remediation Guidance	✓ PASS

Overall Score 5 / 5

Verdict

✓

PASS

AuditAgents successfully identified the DAO-style reentrancy vulnerability, explained the exploit mechanism, described the fund-draining attack path, and provided accurate remediation guidance — all without any hints or prior guidance.