Modeling and Mitigating Reentrancy Attacks: A Decision-Theoretic Framework for Smart Contract Security

Abstract

Reentrancy remains one of the most persistent and damaging vulnerabilities in Ethereum smart contracts, enabling adversaries to recursively drain funds despite the presence of static and runtime defenses. Existing studies mainly focus on detection or program analysis, but they do not explain why and under what conditions attackers decide to exploit. In this work, we introduce a decision-theoretic framework that models reentrancy as a profit-maximizing problem under gas, risk, and atomicity constraints. Our framework derives the conditions under which reentrancy attacks are economically viable and provides an algorithm for computing optimal exploit strategies. We further extend the analysis to multi-contract attacks, capturing sequential, parallel, and optimized execution strategies. A simulation environment evaluates profitability across varying balances and gas configurations, highlighting thresholds where attacks become infeasible. Finally, we translate attacker decision profiles into practical defense recommendations for developers, auditors, and DeFi system designers. This framework bridges the gap between exploit detection and adversarial economics, offering a rigorous basis for strengthening smart contract security. This framework establishes a theoretical baseline for adversarial economics in smart contract security, forming a foundation for future MEV-aware exploitability models and Layer-2 risk analysis.