DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific DeFi smart contract vulnerabilities, formatted for inclusion in a professional security audit report. Each entry includes the vulnerability class, a concrete technical scenario, potential impact, and recommended remediation.

---

1. Reentrancy via External Call in State-Dependent Logic

Vulnerability Class: Reentrancy (CWE-841)

Severity: High

Description:

The contract allows an external call to a user-controlled address after updating internal state but before finalizing the transaction. An attacker can exploit this by deploying a malicious contract that re-enters the vulnerable function during the external call, bypassing state checks.

Specific Scenario:

Consider a function withdraw(uint256 amount) in a lending protocol:

solidity
function withdraw(uint256 amount) external {
    require(balances[msg.sender] >= amount, "Insufficient balance");
    balances[msg.sender] -= amount;