ERC-777/1155/721 hook without reentrancy guard
A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor detects whether the protocol accepts tokens that implement callback hooks -- specifically ERC-777 (tokensReceived via ERC-1820), ERC-1155 (onERC1155Received), or ERC-721 (onERC721Received) -- without applying reentrancy guards to the functions in the protocol that receive or process those tokens. The assessment checks the protocol's supported token list against the set of functions that handle incoming token transfers and verifies guard coverage.
**Why it matters** Non-standard token callbacks invoke external code during a token transfer, before the calling protocol can update its accounting state. Cream Finance ($18.8M, 2021) accepted AMP -- an ERC-777-based ERC-1820 token -- in its borrow() function, which had no reentrancy guard. The attacker exploited the tokensReceived callback to re-enter borrow() before Cream's borrow balance was updated, borrowing multiple times against the same collateral. Revest Finance lost funds via an ERC-1155 onERC1155Received callback; Sovryn via a callTokensToSend hook; Orion Protocol via a fake token transfer hook in its aggregator swap path. The pattern is consistent across four hacks in the dataset.
**Green / Yellow / Red** Green: the protocol either does not accept ERC-777 / ERC-1155 / callback-hook tokens, or all functions that receive such tokens carry nonReentrant guards verified by static analysis. Yellow: callback-hook tokens are accepted but reentrancy guards are present on primary fund-moving functions only, with some peripheral functions (reward claims, yield compounders) unguarded. Red: any core fund-moving function accepts a callback-hook token without a reentrancy guard.
**Common gray cases** This factor is gray when the protocol's accepted token list is not publicly defined or when the token's callback behavior cannot be confirmed without running the token contract's code.
Measurement what to look for #
Determine whether the protocol integrates token standards with callbacks (ERC-777 tokensReceived, ERC-1155 onReceived, ERC-721 onReceived) without reentrancy guards on the affected functions.