Here are three specific DeFi smart contract vulnerabilities commonly identified in professional audit reports, described with technical precision suitable for inclusion in a security assessment.
1. Reentrancy via Unchecked Token Calls (ERC-777/ERC-721 Non-Compliance)
Vulnerability Type: Reentrancy
Severity: High/Critical
Affected Component: Token withdrawal or transfer functions that interact with external tokens.
Description:
The contract assumes that any token compliant with the ERC-20 standard will not invoke callbacks during the transfer or transferFrom functions. However, if the contract interacts with non-standard tokens (such as ERC-777 or malicious ERC-20 tokens), the transfer function may trigger a tokensReceived callback. If the contract has not yet updated its internal accounting state (e.g., user balances) before making the external call, an attacker can re-enter the vulnerable function during the
Top comments (0)