Here are three specific DeFi smart contract vulnerabilities commonly identified in security audits, described with technical precision suitable for inclusion in a formal audit report.
1. Reentrancy Vulnerability in Non-Compliant Functions
Description:
This vulnerability occurs when a smart contract calls an external contract before updating its internal state. If the external contract is malicious, it can re-enter the vulnerable function during the external call, potentially draining funds or corrupting state variables. In modern DeFi protocols, this is particularly dangerous when combined with flash loans, as attackers can exploit the state inconsistency multiple times within a single transaction.
Specific Example:
A lending protocol’s withdraw() function does not follow the "Check-Effect-Interaction" pattern. It allows users to claim accrued interest by:
- Calling an external payout contract to send ETH.
- Only after the external call, updating the user’s balance variable.
Attack Vector:
A malicious contract calls
Top comments (0)