Here are three specific DeFi smart contract vulnerabilities commonly identified in professional security audit reports, detailed with technical context, impact, and remediation guidance:
1. Reentrancy in Shared State Variables
Description:
Reentrancy occurs when an external call to another contract allows the attacker to re-enter the vulnerable function before the state of the current execution is updated. While classic reentrancy in single-function storage updates is well-known, cross-function reentrancy (or "state update after external call") in complex DeFi protocols is a critical variant.
Specific Example:
A staking contract has a withdraw() function that:
- Checks user balance.
- Sends ETH to the user via
call{value: amount}(). - Updates the user’s balance in storage.
If the user is a malicious contract, the call triggers the attacker’s receive() or fallback() function, which re-calls
Top comments (0)