Here are three specific DeFi smart contract vulnerabilities, described with technical depth suitable for inclusion in a professional security audit report. Each entry includes the vulnerability class, a specific scenario, the root cause, and a recommended mitigation.
1. Reentrancy via Unchecked External Calls in Token Swaps
Vulnerability Class: Reentrancy (CWE-693)
Severity: Critical
Affected Component: SwapRouter.sol (or similar interface-based router)
Description
The swap function performs an external call to a token contract’s transfer or safeTransferFrom method before updating the internal state variables that track user balances or pool reserves. If the token being transferred is a malicious ERC-777 or a non-standard ERC-20 that implements a callback (e.g., tokensReceived), the external call can trigger a reentrant call to the same `
Top comments (0)