DeFi Smart Contract Vulnerabilities Audit Guide

Here are three common DeFi smart contract vulnerabilities, detailed with their mechanics and specific detection methods:

1. Reentrancy Attacks

Mechanism:

Reentrancy occurs when a smart contract calls an external contract (e.g., another smart contract or a user’s wallet) before updating its own internal state. A malicious contract can re-enter the first contract during this intermediate state, repeating the vulnerable function before the original call completes. This often leads to unauthorized withdrawals or state inconsistencies.

Specific Detection Methods:

• Control Flow Analysis (CFA): Use static analysis tools (e.g., Slither, Mythril, or Code4rena’s Slither extensions) to identify functions that perform external calls (call, delegatecall, send, transfer) before state variable updates. Flag any function where an external call precedes a state change (SSTORE opcode).
• State Transition Modeling: Model the contract’s state