DeFi Smart Contract Vulnerabilities Audit Guide

Here are three common DeFi smart contract vulnerabilities, along with specific detection methods. These are based on real-world exploits and industry best practices (e.g., from SEC, OWASP Smart Contract Top 10, and audit reports).

---

1. Reentrancy Attacks

Description:

An attacker calls a vulnerable function that sends ETH or tokens to them before the internal state of the contract is updated. They then re-enter the same function before the original call completes, repeating the action to drain funds.

Classic example: The 2016 DAO hack.

Specific Detection Methods:

1. Control Flow Analysis:
   • Look for external calls (e.g., address.transfer(), address.call{value: x}(), or IERC20.transfer()) that occur before state variables are updated (e.g., balances[msg.sender] -= amount;).
   • Rule: En