Here are three specific DeFi smart contract vulnerabilities commonly identified in professional security audits. Each description includes the mechanism of failure, a concrete example, and potential mitigations, suitable for inclusion in an audit report.
1. Reentrancy in Cross-Chain Message Handlers
Vulnerability Type: Reentrancy (External Call Reentrancy)
Severity: High / Critical
Context: Bridges or cross-chain messaging protocols (e.g., LayerZero, Wormhole, Chainlink CCIP) that relay messages between Ethereum and other chains.
Description:
A smart contract receives a cross-chain message and, before updating its internal state, makes an external call to another contract (or even itself via a callback). If the external contract is malicious or compromised, it can re-enter the vulnerable function before the state update completes, allowing an attacker to manipulate the state multiple times.
Specific Example:
Consider a BridgeReceiver contract that holds ERC-
Top comments (0)