DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific DeFi smart contract vulnerabilities commonly identified in professional security audits, formatted for inclusion in a vulnerability report. Each entry includes the CWE/Category, Impact, Technical Explanation, and Remediation.

---

1. Reentrancy in External Calls During State Update

CWE: 841 (Improper Enforcement of Behavioral Workflow) / Reentrancy

Severity: Critical

Description

A vulnerability exists in the withdraw() function of the LiquidityPool contract. The contract updates the user’s balance in storage after making an external call to transfer ETH to the user. This allows an attacker to re-enter the withdraw() function before the state variable is updated, enabling them to withdraw funds multiple times using the same pre-update balance.

Code Example (Vulnerable)

solidity
contract LiquidityPool {
    mapping(address => uint256) public balances;