Here are three specific DeFi smart contract vulnerabilities suitable for inclusion in an audit report, detailed with technical context, impact, and mitigation strategies.
1. Reentrancy Attack via Unprotected State Updates
Vulnerability Type: Access Control / Logic Flaw
CWE: CWE-410 (Inefficient Algorithmic Complexity) / CWE-693 (Protection Mechanism Failure)
Severity: High/Critical
Description
Reentrancy occurs when an external smart contract call is made before the local state variables are updated. An attacker can re-enter the function before the state change is finalized, allowing them to exploit the contract multiple times within a single transaction.
Specific Scenario
Consider a lending protocol with a withdraw() function that allows users to withdraw their deposited ETH. The vulnerable code structure typically follows the CEI (Checks-Effects-Interactions) anti-pattern (i.e., Interactions before Effects):
solidity
Top comments (0)