Here are three common DeFi smart contract vulnerabilities, complete with specific mechanisms of how they occur and concrete methods for detecting them.
1. Reentrancy
What it is: Reentrancy occurs when an external contract calls back into the calling contract before the first invocation is finished. This allows an attacker to repeatedly execute a function (usually a withdrawal) before the contract's state (like user balances) is updated. The most famous historical example of this is the 2016 DAO hack.
Specific Mechanism:
In Solidity, if you use low-level.call()to send ETH to an untrusted address before updating the ledger (e.g.,balances[msg.sender] = 0), the receiving contract can catch that ETH transfer, execute a fallback function, and callwithdraw()again. Because the balance hasn't been zeroed out yet, the contract pays out a
Top comments (0)