DeFi Smart Contract Vulnerabilities Audit Guide

Here are three of the most common and critical DeFi smart contract vulnerabilities, along with specific detection methods. These are drawn from real-world incidents (e.g., MakerDAO, Euler Finance, Curve Finance) and industry standards like the SWC (Smart Contract Weakness Classification).

1. Reentrancy Attacks

Description:

An attacker calls a vulnerable function multiple times before the first call completes, by exploiting external calls to untrusted contracts. This allows state changes (e.g., token transfers) to occur before internal state variables (e.g., user balances) are updated.

Common Scenario:

• A withdraw() function sends ETH or tokens to the caller before updating the caller’s balance in the contract’s internal accounting.
• The attacker’s contract has a fallback function that re-calls withdraw().

How to Detect:

• Static Analysis Tools:
  • Use Slither (by Trail of Bits)