DeFi Smart Contract Vulnerabilities Audit Guide

Here are three of the most prevalent DeFi smart contract vulnerabilities, along with specific methods to detect them. These vulnerabilities are frequently exploited in high-profile hacks (e.g., bZx, Harvest Finance, Curve Finance).

1. Reentrancy Attacks

Description:

Reentrancy occurs when a smart contract makes an external call to an unverified or malicious contract before updating its own state. The malicious contract can then re-enter the vulnerable function before the state change is complete, allowing the attacker to drain funds or manipulate balances.

Specific Detection Methods:

• Static Analysis Tools: Use tools like Slither, Mythril, or Echidna to detect external calls (call, delegatecall) that occur before state variable updates. These tools flag functions where require() or state changes happen after external calls.

solidity
  // Vulnerable Pattern
  function withdraw(uint amount) public {