2026-11-03 –, Lightning Stage
Reentrancy is the boogeyman of smart contract security. We teach developers to fear it, guard against it, and treat any callback as a potential exploit vector. But here's what many security tutorials don't mention: some of the most widely-used protocols in DeFi rely on reentrancy by design.
It's not a bug, it's a feature.
In this session, we step back from the attack narratives and examine reentrancy as a deliberate engineering choice. Through practical examples drawn from production contracts, we'll explore:
Where reentrancy lives on purpose: The common patterns and protocols that intentionally allow or depend on reentrant calls. For some, we will try to understand why their developers made that choice
When the feature becomes the vulnerability: How to distinguish safe architectural reentrancy from the kind that gets you on Rekt News
We'll ground every concept in real code, real protocols, and real design decisions. The same mechanism behind Ethereum's worst hacks also powers its most innovative protocols. The difference is intention, isolation, and understanding.
This session is aimed at developers interested to learn more about secure smart contract coding and architects thinking about how their protocols can work internally. We will assume a basic understanding of Reentrancy.
Dominic Bruetsch is a founding partner and lead blockchain security engineer at ChainSecurity. He specializes in smart contract audits on Ethereum, Starknet, as well as zk circuit audits. He holds a master's degree from ETH Zurich, one of the best universities in the world for computer science, in electrical engineering with a focus on networks and computer science. He found vulnerabilities in the Ethereum protocol itself, which landed him a sport on the Ethereum Bug bounty leaderboard.