Here are three specific DeFi smart contract vulnerabilities, described with the technical precision and structure required for a professional security audit report.
1. Reentrancy Attack via Unprotected External Calls
Vulnerability Type: Reentrancy
Severity: High
Affected Component: LendingPool.sol – withdraw() function
Description:
The withdraw() function allows users to reclaim their deposited assets. The function performs an external call to the user’s wallet (msg.sender.transfer(amount)) before updating the internal balance mapping (balances[msg.sender] -= amount). This violates the Checks-Effects-Interactions (CEI) principle.
An attacker can exploit this by calling withdraw() from a malicious contract. When the external call is made, the attacker’s fallback function is executed, which can recursively call withdraw() again. Since the internal state has not yet been updated, the balance check passes once more, allowing the attacker to drain the
Top comments (0)