Here are three specific, high-impact DeFi smart contract vulnerabilities commonly identified in professional audits. Each includes a technical description, root cause, impact, and recommended mitigation.
1. Reentrancy Attack via Unprotected State Updates
Vulnerability Type: CWE-841 (Improper Enforcement of Behavioral Workflow)
Severity: Critical
Affected Patterns: Lending protocols, flash loan contracts, yield aggregators
Description
Reentrancy occurs when a contract makes an external call (e.g., transfer() or transferFrom()) before updating its internal state variables. If the called contract is malicious or contains logic that allows callback into the vulnerable function, an attacker can re-enter the function before the state update, manipulative the protocol’s accounting.
In modern Solidity (0.8.0+), reentrancy is less trivial due to the nonreentrant modifier being more commonly applied, but **cross-function re
Top comments (0)