DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific, high-impact DeFi smart contract vulnerabilities suitable for inclusion in a professional audit report. Each includes the technical mechanism, potential impact, and remediation strategy.

---

1. Reentrancy in State-Dependent Functions (CWE-693)

Vulnerability Description:

A reentrancy vulnerability occurs when an external contract call is made before the internal state of the current contract is fully updated. If the external call allows the attacker to re-enter the same function, they can manipulate the state multiple times before the original execution completes. This is particularly dangerous in functions that involve both state changes and external calls (e.g., token transfers, price updates, or reward distributions).

Specific Scenario:

Consider a staking contract with a claimRewards() function:

solidity
function claimRewards() external {
    uint256 reward = calculateReward(msg.sender);
    //