Here are three specific DeFi smart contract vulnerabilities commonly identified in security audits, described with technical precision suitable for an audit report.
1. Reentrancy Attack via Unchecked External Calls
Severity: Critical
Vulnerability Type: Reentrancy (CWE-841)
Description:
The contract allows state changes (e.g., updating user balances) before executing an external call to an untrusted address (e.g., transfer() or call{value:...}). If the external call invokes a malicious contract that re-enters the vulnerable function before the state is fully updated, an attacker can repeatedly drain funds.
Example Scenario:
In a simple lending protocol, the withdraw() function updates the user’s balance in the internal ledger before sending ETH to the user. A malicious contract can intercept the ETH transfer and recursively call withdraw() before the first call’s state update is finalized, allowing the attacker to withdraw
Top comments (0)