Here are three specific DeFi smart contract vulnerabilities commonly identified in professional audit reports, complete with technical descriptions, impact analysis, and mitigation strategies.
1. Reentrancy in Oracle Price Feeds
Description:
Reentrancy occurs when an external call to another contract allows that contract to call back into the original function before the first call has finished. While classically associated with transfer calls in ERC-20 tokens, a critical variant exists in oracle-based price retrieval. If a smart contract fetches a price from an external oracle (e.g., Chainlink, Uniswap V2/V3 pools) and uses that price for a state-changing operation (like a swap, loan, or token mint), but fails to validate the freshness or integrity of the returned data, an attacker can manipulate the price feed.
Specific Scenario:
A lending protocol allows users to borrow stablecoins against ETH collateral. The contract uses oracle.latestRoundData()
Top comments (0)