DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific DeFi smart contract vulnerabilities commonly identified in audit reports, described with technical precision and real-world implications:

1. Reentrancy via Unchecked External Calls

Vulnerability Class: CWE-841 (Insecure Method of Accessing Shared Resources)

Severity: Critical

Description:

Reentrancy occurs when a contract makes an external call to an untrusted address before updating its internal state. If the external contract is malicious, it can re-enter the vulnerable function before the state change is committed, allowing the attacker to repeatedly drain funds.

Specific Example:

In a lending protocol’s withdraw() function:

solidity
function withdraw(uint256 amount) external {
    require(balances[msg.sender] >= amount, "Insufficient balance");
    // VULNERABILITY: State not updated before external call
    (bool success, ) = msg.sender.call{value: amount}("");