Update EIP-223: Update eip-223.md

Merged by EIP-Bot.

EIPS/eip-223.md

@@ -97,6 +97,8 @@ function transfer(address _to, uint _value) returns (bool)
 This function must transfer tokens, and if `_to` is a contract, it must call the `tokenReceived(address, uint256, bytes calldata)` function of `_to`. If the `tokenReceived` function is not implemented in `_to` (recipient contract), then the transaction must fail and the transfer of tokens must be reverted.
 If `_to` is an externally owned address, then the transaction must be sent without executing `tokenReceived` in `_to`.
  `_data` can be attached to this token transaction, but it requires more gas. `_data` can be empty.
+
+ The `tokenReceived` function of `_to` MUST be called after all other operations to avoid re-entrancy attacks.
 
 ##### `transfer(address, uint, bytes)`
 
@@ -108,7 +110,9 @@ This function must transfer tokens and invoke the function `tokenReceived (addre
 If `_to` is an externally owned address (determined by the code size being zero), then the transaction must be sent without executing `tokenReceived` in `_to`.
  `_data` can be attached to this token transaction, but it requires more gas. `_data` can be empty.
 
-NOTE: A possible way to check whether the `_to` is a contract or an address is to assemble the code of `_to`. If there is no code in `_to`, then this is an externally owned address, otherwise it's a contract.116
+NOTE: A possible way to check whether the `_to` is a contract or an address is to assemble the code of `_to`. If there is no code in `_to`, then this is an externally owned address, otherwise it's a contract.
+
+The `tokenReceived` function of `_to` MUST be called after all other operations to avoid re-entrancy attacks.
 
 #### Events