Here are three specific DeFi smart contract vulnerabilities commonly identified in professional audits, described with technical specificity suitable for an audit report:
1. Reentrancy Attack via Unchecked External Calls
Severity: High/Critical
Vulnerability Type: CWE-841 (Improper Enforcement of Behavioral Workflow)
Description:
The withdraw() function in the target protocol allows users to claim assets by calling an external contract (e.g., an ERC-20 token transfer) before updating the internal user balance state. This violates the CEI (Checks-Effects-Interactions) pattern. If the external contract is malicious, it can re-enter the withdraw() function before the balance update occurs, allowing the attacker to drain the protocol’s reserves multiple times using the same initial balance.
Example Vulnerable Code:
solidity
function withdraw(uint256 amount) external nonReentrant {
// 1. Check
Top comments (0)