Every audit I've conducted over the past two decades reveals the same uncomfortable truth: most blockchain breaches aren't caused by sophisticated cryptographic failures. They happen because teams underestimate well-documented attack patterns that have been costing the industry billions. In 2023 alone, DeFi protocols lost over $1.8 billion to exploits, and the vast majority were preventable.
I'm André Dias Moreira Prol, and after 20+ years working with Web3 infrastructure, Stellar, Soroban and digital forensics, I've seen that security isn't a feature you add at the end. It's a mindset you build from the first line of code. Let me share the five most common attacks and, more importantly, how to defend against them.
The 5 Attacks That Drain Projects
1. Reentrancy attacks. The classic that took down The DAO in 2016 (~$60M) still claims victims. It occurs when a contract calls an external contract before updating its own state, allowing an attacker to recursively drain funds. On Ethereum this is notorious, but even Soroban developers must respect state-update ordering.
2. Oracle manipulation. Attackers exploit price feeds to trick protocols into mispricing assets. The Mango Markets exploit ($114M in 2022) is a textbook case: manipulate a thin market, inflate collateral value, borrow against it. If your project relies on a single oracle source, you're one flash loan away from disaster.
3. Flash loan attacks. These combine borrowed capital with other vulnerabilities to execute complex, atomic exploits. Because the loan is repaid within the same transaction, attackers risk almost nothing. The bZx and Cream Finance incidents demonstrated how devastating uncollateralized capital can be when logic is flawed.
4. Access control failures. Missing or misconfigured permission checks. In 2023, several projects lost funds simply because an initialize function could be called by anyone, or admin keys weren't properly rotated. Boring? Yes. Costly? Absolutely.
5. Integer overflow/underflow. Less common now thanks to safe math libraries, but legacy contracts and custom arithmetic still fall victim, especially in tokenization logic where I frequently review balance calculations.
Building Defense in Depth
In my experience, no single tool saves a project. The strongest security postures I've helped design layer multiple defenses:
- Checks-Effects-Interactions pattern: Always update internal state before making external calls. This alone neutralizes most reentrancy vectors.
- Multiple decentralized oracles: Use time-weighted average prices (TWAP) and aggregate sources like Chainlink or Stellar's Reflector to resist manipulation.
- Reentrancy guards and mutex locks: Cheap to implement, invaluable in practice.
- Rigorous access control: Adopt role-based permissions, multisig for admin functions, and timelocks on critical operations. On Stellar, I lean heavily on native multisig capabilities.
- Automated testing and fuzzing: Tools like Foundry's fuzzer or Soroban's testing framework expose edge cases humans miss.
I always tell teams: assume every external input is hostile. That single assumption changes how you write code.
Auditing and Forensic Readiness
Prevention matters, but so does knowing what to do when something goes wrong. My digital forensics background taught me that most projects can't answer a basic question after a hack: what actually happened?
Build observability from day one. Emit detailed events, maintain immutable logs, and monitor on-chain activity with real-time alerts for anomalous transactions. When I investigate incidents, projects with clean event trails recover funds and reputation far faster than those flying blind.
Formal audits are non-negotiable for anything holding real value. But an audit is a snapshot, not a guarantee. Combine third-party reviews with bug bounties on platforms like Immunefi, and re-audit after every significant upgrade. As André Dias Moreira Prol, I've learned that the projects that survive treat security as a continuous process, never a checkbox.
Conclusion
Blockchain security is fundamentally about discipline: known attacks, known defenses, consistently applied. Don't wait for an exploit to take these threats seriously.
Audit your smart contracts today and, if you need experienced eyes on your Stellar, Soroban or tokenization project, reach out to start building security in from the very first commit.
Follow more articles by André Dias Moreira Prol on Medium.
Top comments (0)