Here are three critical DeFi smart contract vulnerabilities, described with the specificity required for a professional security audit report. Each entry includes the vulnerability class, technical mechanism, impact, and recommended mitigation.
1. Reentrancy in Cross-Contract Callbacks (CVE-2020-7248 Pattern)
Vulnerability Class: Reentrancy
Severity: Critical
Affected Component: ExchangeWithdrawal function in a DEX liquidity pool contract.
Technical Description:
The withdrawLiquidity() function initiates an external call to the native token contract (e.g., ERC-20) via transferFrom() before updating the local state variable userShare. Because the external call occurs before state modification, a malicious contract can intercept the callback and recursively invoke withdrawLiquidity() multiple times before the original call completes. This allows the attacker to drain the pool’s liquidity by re-entering the function with
Top comments (0)