Here are three critical DeFi smart contract vulnerabilities, described with technical specificity suitable for inclusion in a formal security audit report. Each entry includes the vulnerability class, root cause, impact, and a recommended mitigation strategy.
1. Unchecked Return Value from External Call (Silent Failure)
Vulnerability Class: G.20 – Return Value Ignored
CWE: CWE-252 – unchecked return value
Severity: High
Description:
The contract performs a cross-contract interaction (e.g., calling transfer() or safeTransferFrom() on an ERC-20 token) but does not check the boolean return value of the external call. While ERC-20 standard mandates that transfer() should revert on failure, many non-standard or "fake" tokens return false instead of reverting when a transfer fails (e.g., due to insufficient balance or allowance). If the calling contract ignores this false return,
Top comments (0)