DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific DeFi smart contract vulnerabilities commonly identified in professional security audits, described with technical precision suitable for an audit report.

1. Reentrancy in Callback Functions (CWE-252)

Vulnerability Description:
This vulnerability occurs when a contract makes an external call to an untrusted address (e.g., msg.sender) before updating its internal state variables. If the external contract is malicious, it can re-enter the vulnerable function before the state update is complete, allowing an attacker to repeatedly execute the logic with the same initial state.

Specific Scenario:
In a lending protocol, the withdraw() function allows users to claim accrued interest. The vulnerable implementation:

1. Calculates the user’s interest balance.
2. Sends the ETH via address(user).call{value: amount}("").
3. Only after the external call does it update userInterest[user] = 0.