Is my withdraw function vulnerable to reentrancy?

Smart Contracts
1

I have a pay ETH function in my smart contract. I deployed it ages ago and only just realized it might be vulnerable to reentrancy attacks.
Is it? I know that the msg.sender.transfer() max gas is 2300 but I don't know if its still vulnerable..

function payETH() external payable {
    uint256 amount = msg.value;
    uint256 existing = ethLoaned[msg.sender];
    if (amount > existing) {
        msg.sender.transfer(amount - existing);
        amount = existing;
    }
    ethLoaned[msg.sender] -= amount;
    emit Payback(msg.sender, amount);
}
2

yes, it is vulnerable to reentrancy attacks. Do not use the contract any further and try to withdraw any funds you may have deposited.

3

But what about the 2300 gas fee? Wouldn't it be safe to reentrancy attacks because it limits gas fees

4

Correct -- as of the current state, that non-reentrancy assumption holds up as it's is enforced by EIP-2200, However, this can change in future network upgrades.

It's recommended to prevent reentrancy more explicitly, like by using ReentrancyGuard.