Here are three specific DeFi smart contract vulnerabilities commonly identified in professional audit reports, described with technical precision suitable for inclusion in a formal security assessment.
1. Reentrancy in Price Oracle Updates (Cross-Contract Reentrancy)
Description:
This vulnerability occurs when a smart contract calls an external contract (such as an oracle or another DeFi protocol) and allows state changes before the external call completes. If the external contract is malicious or compromised, it can re-enter the calling contract before the state has been fully updated, leading to inconsistent state or unauthorized actions.
Specific Technical Scenario:
Consider a lending protocol that uses a decentralized oracle (e.g., Chainlink or a custom TWAP) to fetch asset prices. The protocol’s updateReserve() function first calls the oracle’s getPrice() function and then updates the internal reserveData storage variable with the new price and liquidity metrics. If the oracle’s getPrice() function triggers a
Top comments (0)