Here are three specific DeFi smart contract vulnerabilities commonly identified in professional audit reports, described with technical precision suitable for inclusion in a formal security assessment.
1. Reentrancy Vulnerability in Non-Atomic State Updates
Description:
This vulnerability occurs when a smart contract performs an external call (e.g., sending ETH to another contract) before updating its internal state variables. If the external contract is malicious, it can re-enter the vulnerable function before the state update completes, allowing repeated withdrawals or state manipulation.
Specific Example:
A withdraw() function in a lending protocol executes the following logic:
- Calculates the user’s withdrawal amount.
- Sends ETH to the user via
address payable(user).transfer(amount). - Updates the user’s balance in the contract’s storage:
balances[user] -= amount.
Exploit Vector:
A malicious contract calls withdraw(). During the transfer() call, the malicious contract’s
Top comments (0)