Here are three specific DeFi smart contract vulnerabilities commonly identified in professional security audits, described with technical precision suitable for inclusion in an audit report.
1. Reentrancy Attack via Unprotected External Calls
CWE: CWE-693 (Protection Mechanism Failure)
Severity: High/Critical
Description:
This vulnerability occurs when a contract makes an external call (e.g., to a user-controlled address or another contract) before updating its internal state. If the external call triggers a callback into the vulnerable function (directly or indirectly), an attacker can re-enter the function and execute the logic again before the state is finalized.
Specific Example:
In a token withdrawal function, if the contract sends ETH to the user via address(user).call{value: amount}("") before subtracting the amount from the user’s balance mapping, a malicious contract can intercept the ETH and re-invoke the withdrawal function. Because the balance has
Top comments (0)