DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific DeFi smart contract vulnerabilities commonly identified in professional audits, described with technical precision suitable for an audit report.

1. Reentrancy Due to Lack of Checks-Effects-Interactions (CEI) Pattern

Severity: High

CWE: CWE-841 (Improper Enforcement of Behavioral Workflow)

Description:

The withdraw() function in the LiquidityPool contract allows users to withdraw their share of the pool’s assets. The implementation performs an external call to transfer Ether (or ERC-20 tokens) to the user before updating the user’s balance in the contract’s internal state. This violates the Checks-Effects-Interactions pattern.

Code Example (Vulnerable):

solidity
function withdraw() external {
    uint256 amount = balances[msg.sender];
    require(amount > 0, "No balance");

    // INTERACTION (External Call)