Here are three common DeFi smart contract vulnerabilities, along with specific detection methods and examples.
1. Reentrancy Attacks
Description:
A reentrancy attack occurs when a smart contract calls an external contract (e.g., another token or ETH recipient) before updating its internal state. The external contract can then call back into the vulnerable function, allowing an attacker to drain funds by repeatedly re-entering the function before the state is finalized.
Example:
An ERC-20 token’s withdraw() function sends ETH to the user before decreasing the user’s balance. The user’s contract (or a malicious contract) calls withdraw() again in its receive() function, bypassing the balance check.
Detection Methods:
- Control-Effect-Interaction (CEI) Pattern Check: Verify that state changes (effects) occur before external calls (interactions). Use static analysis tools like Slither or **My
Top comments (0)