Did you know that a fallback function was used inside the attacker contract for the Re-Entrancy Attack or the DAO Attack that happened some years back and was one of the biggest and worst attacks ever to happen in the history of the Ethereum blockchain? This attack is often cited as an important example of smart contract vulnerabilities and has led to increased awareness and emphasis on the importance of secure smart contract programming practices and thorough security audits.

The attack was caused due to the order of execution of two lines of code, demonstrating how even minor mistakes in smart contract programming can have devastating consequences. Due to the immutability of the blockchain, it was challenging for the Ethereum community developers and core development team to figure out a fix for this drain. Finally, everyone had to narrow down one last piece of choice that they could make, which was to “fork” the Ethereum blockchain which was to upgrade the chain with new technical standards and rules which are agreed upon by most nodes present in the network. This majority agreement was based on the concept of a 51% attack, but the attack here was to hard fork the current implementation of the Ethereum blockchain network. This led to the division from the original blockchain which later was named the Ethereum Classic blockchain.

Coming back to our main point – “fallback” functions, understanding from its actual meaning which is an alternative or a backup plan and it applies and functions to our contract language in the same way. Whenever a function that is not defined in our smart contract is being called then the fallback function is fired and code under its definition is executed. The fallback functions are also called when the contract receives ether. This feature was exploited by the attacker in his smart contract.

I’ll be explaining the process by which the attacker made use of the fallback function to drain the DAO contract. Since you have already understood how fallbacks work, let’s start with the structure of our attacker’s smart contract – it contains 3 functions – attack function, getBalance function and finally our fallback function which is the core cause of the DAO hack. The key vulnerability in the DAO contract was that it updated the investor’s balance only after the withdrawal function was called, leaving a window for exploitation through a reentrancy attack. The process started with the user investing in the DAO contract by transferring ETH to the contract. When the user called the withdraw function to retrieve their funds from the contract, the execution began. As Ether was being transferred from the DAO contract to the attacker’s contract, the fallback function of the attacker’s contract started firing. Inside the fallback function, since the DAO contract had not updated the balances yet, it called the withdraw function again, leading to a loop of calls to the withdraw function. This loop caused a drain of funds from the DAO contract, resulting in the exploitation of the vulnerability.

The execution of the transfer function in the DAO contract is dependent on the fallback function of the attacker’s contract so that it keeps on executing withdraw function without resetting the user’s balance on the DAO contract. This led to the infinite draining loop of the DAO contract’s investment funds – LIKE how crazy is that?? Even after undergoing hundreds of smart contract audits – they couldn’t have thought of just swapping two lines of code and all of this wouldn’t have happened.

Indeed, the attacker exploited the fallback function to extract and steal Ether from the DAO contract, causing shock and raising awareness about the critical importance of smart contract security within the community. This incident highlighted the need for thorough vulnerability checks before deploying any smart contract. Companies and organizations such as OpenZeppelin and Nethermind offer services for smart contract audits, which are highly valued and in demand in the web3 industry. Smart contract auditors are well-compensated for their expertise, as the process requires careful analysis of every line of code to ensure robust security measures are in place.