DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific DeFi smart contract vulnerabilities commonly identified in security audits, described with technical precision suitable for an audit report.

1. Reentrancy Attack via Unchecked External Calls

CWE-841 (Improper Enforcement of Behavioral Workflow) / CWE-693 (Protection Mechanism Failure)

Description:

A state-changing function in a smart contract executes an external call (e.g., transfer() to a user or another protocol) before updating the internal state variables (e.g., user balances). If the external call invokes a callback function (common in ERC-777 tokens or contracts with receive()/fallback functions), an attacker can re-enter the vulnerable function before the state is finalized.

Specific Example:

solidity
// Vulnerable Pattern
function withdraw(uint256 amount) external {
    require(balances[msg.sender] >= amount, "Insufficient balance");