Here are three specific DeFi smart contract vulnerabilities, described with technical detail suitable for an audit report. Each includes the mechanism of exploitation, impact, and recommended mitigation.
1. Reentrancy via Unchecked External Calls in Token Swaps
Vulnerability Type: Reentrancy
Severity: High
CWE: CWE-693 (Protection Mechanism Failure) / CWE-404 (Improper Resource Shutdown or Release)
Description
This vulnerability occurs when a smart contract (e.g., an automated market maker [AMM] router or exchange contract) calls an external, untrusted contract (such as a malicious ERC-20 token) before updating internal state variables (e.g., balances, reserves, or lock states). If the external contract is malicious, it can re-enter the calling function during the external call, allowing the attacker to drain funds or manipulate state before the first transaction completes.
Top comments (0)