DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific DeFi smart contract vulnerabilities commonly encountered in audits, described with technical precision suitable for an audit report:

1. Reentrancy via External Calls (CWE-693)

Severity: High/Critical

Description:

The smart contract allows an attacker to re-enter a vulnerable function before its initial execution completes, by triggering another call to the same contract through an external interaction (e.g., transfer, swapExactTokensForTokens, or custom external calls). This is particularly dangerous in functions that update state variables after making external calls.

Example Vulnerable Pattern:

solidity
function withdraw() external {
    uint256 amount = balances[msg.sender];
    require(amount > 0, "no funds");

    // STATE CHANGE SHOULD OCCUR BEFORE EXTERNAL CALL
    // VULNERABILITY: State is updated AFTER external call
    (bool success, ) = msg.sender.call