Here are three specific DeFi smart contract vulnerabilities commonly identified in security audits, described with technical precision suitable for an audit report.
1. Reentrancy Attack via Unchecked External Calls
Vulnerability Class: CWE-841: Automated Denial of Service (DoS) / Reentrancy
Severity: Critical
Description:
This vulnerability occurs when a smart contract makes an external call to an untrusted or semi-trusted contract before updating its internal state (e.g., balance, allowance, or position). If the external contract is malicious, it can re-enter the vulnerable function before the first execution completes, allowing the attacker to drain funds or manipulate state multiple times within a single transaction.
Specific Scenario:
A liquidity pool contract implements a withdraw() function that:
- Calculates the user’s withdrawal amount.
- Calls
msg.sender.transfer(amount)to send ETH. - Updates `userBalances[msg.sender]
Top comments (0)