Here are three specific DeFi smart contract vulnerabilities commonly identified in professional audit reports, complete with technical context, root causes, and remediation strategies.
1. Reentrancy via Callbacks in Cross-Protocol Interactions
Vulnerability Class: Reentrancy (CWE-841)
Severity: High/Critical
Common Context: Yield Aggregators, Vaults, and Multi-Step Swaps
Description
While classic reentrancy (e.g., in ERC-20 balances) is often mitigated by using nonReentrant modifiers or checks-effects-interactions (CEI) patterns, cross-protocol reentrancy remains a prevalent risk. This occurs when a contract calls an external protocol (e.g., a lending market or AMM) that allows user-supplied callbacks or custom logic during the transaction.
Specific Scenario
A vault contract (Vault.sol) performs a two-step operation:
1
Top comments (0)