Here are three specific DeFi smart contract vulnerabilities suitable for inclusion in an audit report. Each entry includes the technical mechanism, a realistic code example (Solidity), the impact, and recommended mitigations.
1. Unchecked Return Values from transfer/transferFrom (ERC-20 Interface Violation)
Vulnerability Type: External Call Failure / Return Value Ignored
Severity: High
CWE: CWE-252 (Unchecked Return Value)
Description
Many early ERC-20 tokens (e.g., USDT) do not return a boolean value from transfer() or transferFrom(). They may only return nothing or revert on failure. If a smart contract assumes these functions return true and does not check the return value, the transaction may appear successful to the caller even if the token transfer failed silently. This leads to accounting discrepancies, stuck funds, or unauthorized access.
Top comments (0)