Here are three specific, high-impact DeFi smart contract vulnerabilities commonly identified in professional audits, formatted for inclusion in an audit report. Each entry includes the vulnerability type, technical description, impact, and remediation.
1. Unchecked External Calls (Reentrancy)
CWE-366: Concurrent Execution using Shared Resource with Mutual Exclusion
Description:
The contract fails to enforce the Checks-Effects-Interactions pattern during state-changing operations that involve external calls. Specifically, in the withdraw() function of a yield-bearing vault, the contract updates the user’s balance after calling an external transfer() function to send funds. This allows an attacker to re-enter the withdraw() function before the state is updated, enabling them to withdraw more than their actual balance.
Example Snippet (Vulnerable):
solidity
function withdraw(uint256 amount) external
Top comments (0)