DeFi Smart Contract Vulnerabilities Audit Guide

Here are three common DeFi smart contract vulnerabilities, along with specific detection methods and examples.

1. Reentrancy Attacks

Description:

A reentrancy attack occurs when a contract calls an external contract and then modifies its internal state after the external call. Malicious contracts can re-enter the vulnerable function before the state is updated, allowing them to drain funds.

Specific Example:

A withdraw() function that sends Ether via msg.sender.call{value: amount}("") before updating the user’s balance. The attacker’s fallback function calls withdraw() again, seeing the old (higher) balance.

Detection Methods:

• Static Analysis Tools: Use tools like Slither or Mythril. Slither specifically flags functions with external calls followed by state changes without proper guards.
  • Command: slither --detection-profile default contract.sol
  • Look for: `reentrancy