Here are three specific DeFi smart contract vulnerabilities commonly identified in professional audit reports, including their mechanisms, impact, and prevention strategies.
1. Reentrancy Attack via Unprotected External Calls
Vulnerability Type: Reentrancy (CWE-369)
Severity: Critical
Affected Pattern: Token swaps, staking withdrawals, or any function that sends ETH/tokens before updating internal state.
Description
A reentrancy attack occurs when a smart contract makes an external call to an untrusted or semi-trusted contract before completing its state changes. The external contract can then re-enter the vulnerable function before the first invocation has finished, allowing an attacker to drain funds or manipulate state multiple times.
Specific Example
solidity
// VULNERABLE CODE
function withdraw() public {
uint256 amount = balances[msg.sender];
require(amount > 0, "No balance
Top comments (0)