DeFi Smart Contract Vulnerabilities Audit Guide

Here are three common DeFi smart contract vulnerabilities, along with specific methods for detecting them. Each example includes a concrete scenario and actionable detection strategies.

1. Reentrancy Attacks

Vulnerability Description:

Reentrancy occurs when a function makes an external call to an untrusted contract and allows that contract to re-enter the vulnerable function before the first execution completes. This is most famously exploited in the withdraw function of token or lending protocols, where the state change (e.g., updating user balance) happens after the external call (e.g., sending ETH).

Specific Example:

solidity
function withdraw(uint256 amount) external {
    require(balances[msg.sender] >= amount, "Insufficient balance");
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success, "Transfer failed");
    balances[msg.sender] -= amount; // State change happens AFTER external call