A Tale of Two Calls: How a Reentrancy Attack Can Take Over Maker's CDPs

Some time ago, I was reviewing an implementation of ERC-3156 and decided to hunt for some unprotected flashloan callbacks. While this depends on the specifics of each case, you usually need a check to restrict who is calling this hook, making it easy...