Here are three of the most common and critical DeFi smart contract vulnerabilities, along with specific detection methods used by security auditors and developers.
1. Reentrancy
Description:
Reentrancy occurs when a contract calls an external contract (e.g., sending ETH or tokens) and the external contract calls back into the vulnerable contract before the first call has finished executing. If the state variables (like user balances) are not updated before the external call, an attacker can repeatedly re-enter the function and drain funds. The classic example is the 2016 DAO hack.
Detection Methods:
-
State Change Before External Call (Check-Effects-Interactions Pattern):
Auditors manually review functions that perform external calls (
call,transfer,staticcall) and verify that all state changes (e.g.,balances[addr] -= amount) occur before the external call. If state changes happen after, it
Top comments (0)