Here are three specific DeFi smart contract vulnerabilities commonly identified in security audits, described with technical precision suitable for an audit report.
1. Reentrancy in Price Oracle Updates (Flash Loan Attack Vector)
Vulnerability Class: Reentrancy / Oracle Manipulation
CWE: CWE-841 (Improper Enforcement of Behavioral Workflow)
Severity: Critical
Description:
A smart contract relies on a pull-based price oracle (e.g., Chainlink or TWAP aggregator) that allows external contracts to update the stored price before the core logic (e.g., loan liquidation or swap execution) reads it. If the price update function does not enforce strict access control or state checks, an attacker can exploit flash loans to temporarily manipulate the on-chain price.
Specific Scenario:
- The contract contains a function
updatePrice()that accepts auint256 newPriceparameter.
Top comments (0)