Here are three specific DeFi smart contract vulnerabilities suitable for inclusion in a professional audit report. Each entry includes the technical mechanism, a realistic code scenario, and the potential impact.
1. Reentrancy Attack via Unchecked External Calls
Vulnerability Class: Reentrancy (CWE-841)
Severity: Critical
Likelihood: Medium (if external calls are frequent and state updates are delayed)
Description
Reentrancy occurs when a contract makes an external call to an untrusted third party before updating its internal state. A malicious contract can exploit this by re-entering the function during the external call, allowing it to withdraw funds multiple times before the original transaction’s state is finalized.
Specific Scenario: Lending Protocol withdraw() Function
A lending protocol allows users to withdraw borrowed assets. The flawed logic uses the Checks-Effects-Interactions pattern incorrectly by performing the external transfer before updating the user’s
Top comments (0)