Here are three specific DeFi smart contract vulnerabilities commonly identified in professional audit reports, described with technical precision suitable for a security assessment document.
1. Reentrancy in Non-View/Non-Pure Functions with External Calls Before State Updates
Vulnerability Class: CWE-841 (Automated Logic Error) / Reentrancy
Severity: Critical/High
Description:
This vulnerability occurs when a smart contract makes an external call to an untrusted address (e.g., via call, delegatecall, or transfer) before completing all state changes in the current transaction. If the external contract is malicious, it can re-enter the vulnerable function before the original execution context has updated the relevant state variables (such as user balances or withdrawal allowances).
Specific Technical Example:
In a token staking contract, the withdraw() function performs the following steps:
- Calculates the amount to pay out.
- Executes `msg
Top comments (0)