DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific DeFi smart contract vulnerabilities commonly identified in high-impact audit reports, described with technical precision suitable for a professional security audit.

1. Reentrancy in State-Dependent Functions

CWE-693: Protection Mechanism Failure

Description:

This occurs when a smart contract function modifies its internal state (e.g., updating a user’s balance or share amount) after making an external call to an untrusted contract (e.g., transfer or call). If the external contract is malicious, it can re-enter the vulnerable function before the state update is finalized, leading to double-spending or infinite loop exploits.

Specific Scenario (Example: Token Swap Function):

solidity
function swap(uint256 amount) external nonReentrant { // ❌ Missing or incorrectly placed modifier
    // 1. Calculate output
    uint256 out = getOutputAmount(amount);