Here are three specific DeFi smart contract vulnerabilities, detailed in the format typically used in professional security audit reports. Each entry includes the vulnerability class, a technical description, potential impact, and a recommended mitigation strategy.
1. Reentrancy in Compound Interest Calculation
Vulnerability Class: Reentrancy (CWE-841)
Severity: Critical
Affected Component: StakingPool.sol, withdraw() function
Description:
The withdraw() function allows users to redeem their staked tokens. The function updates the user’s internal balance in the mapping balances[msg.sender] after the external call to IERC20(token).transfer(msg.sender, amount). This violates the Checks-Effects-Interactions pattern.
An attacker can deploy a malicious contract that calls withdraw() and, within the transfer callback (via ERC-777 or a custom token with hooks), re-enter the
Top comments (0)