DeFi Smart Contract Vulnerabilities Audit Guide

Here are three common DeFi smart contract vulnerabilities, along with specific detection methods and examples.

1. Reentrancy Attack

What it is:

Reentrancy occurs when a contract makes an external call to an untrusted contract before updating its own state. The external contract can then re-enter the vulnerable function before the state change is finalized, allowing an attacker to drain funds repeatedly.

Specific Example:

A withdraw() function that sends ETH to a user before decrementing the user’s balance:

function withdraw(uint amount) external {
    require(balances[msg.sender] >= amount);
    // VULNERABLE: External call before state update
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success);
    // State update happens too late
    balances[msg.sender] -= amount;
}

How to Detect:

• **Static Analysis Tools