Here are three specific DeFi smart contract vulnerabilities, described in the format typically found in a professional security audit report. Each entry includes the vulnerability class, technical explanation, potential impact, and remediation advice.
1. Reentrancy Attack via Unchecked External Calls
Vulnerability Class: CWE-841 (Improper Enforcement of Behavioral Workflow) / Reentrancy
Severity: Critical
Location: SwapContract.withdraw() function, lines 142–158
Description:
The withdraw() function allows users to reclaim their deposited assets. The contract first updates the user’s balance in the internal state variable balances[msg.sender] after executing an external call to transfer tokens via token.safeTransfer(msg.sender, amount). This violates the Checks-Effects-Interactions pattern.
An attacker can deploy a malicious contract that calls withdraw(). During the external safeTransfer call, the
Top comments (0)