Here are three specific DeFi smart contract vulnerabilities commonly identified in professional audits, described with technical precision suitable for inclusion in an audit report.
1. Reentrancy via Unchecked External Calls in Callback Functions
Vulnerability Class: CWE-841 (Improper Enforcement of Behavioral Workflow) / Reentrancy
Severity: High
Location: SwapRouter.sol, function swapExactETHForTokensSupportingFeeOnTransferTokens(uint amountOutMin, address[] path, address to, uint deadline)
Description:
The swapExactETHForTokensSupportingFeeOnTransferTokens function performs multiple external calls to the Uniswap V2 router and recipient contracts before updating the internal accounting state. Specifically, the contract calls recipient.transferFrom() or interacts with token contracts that may implement non-standard transfer/transferFrom semantics (e.g., "fee-on-transfer" or "re-entrancy-enabled
Top comments (0)