DeFi Smart Contract Vulnerabilities Audit Guide

Here are three common DeFi smart contract vulnerabilities, along with specific methods to detect them. These are based on well-documented attack vectors and industry-standard auditing practices.

1. Reentrancy

What it is:

Reentrancy occurs when a contract calls an external contract (e.g., transfer() in ERC-20) before updating its own internal state (e.g., user balances). If the external contract has a fallback function that calls back into the original contract before the state update completes, the attacker can repeatedly drain funds by re-entering the vulnerable function.

Specific Detection Methods:

• Static Analysis Tools:
  • Use tools like Slither (by Trail of Bits) or Mythril. These tools model control flow graphs and flag functions that make external calls (CALL, DELEGATECALL) before state-changing operations (SSTORE).
  • Example Slither output: `warning(reentr