DeFi Smart Contract Vulnerabilities Audit Guide

Here are three of the most common and damaging DeFi smart contract vulnerabilities, along with specific methods and tools used to detect them.

1. Reentrancy Attacks

Description:

Reentrancy occurs when a contract calls an external contract, which then calls back into the first contract before the first contract has finished its transaction. This allows an attacker to re-enter the vulnerable function and drain funds multiple times before the state variables are updated. The most famous example is the 2016 DAO hack.

How to Detect:

• Static Analysis Tools: Use tools like Slither (by Trail of Bits) or Mythril. These tools analyze the abstract syntax tree (AST) of the Solidity code to identify external calls (call, delegatecall, send, transfer) that occur before state changes.
  • Example Slither Output: reentrancy-eth: External calls made before state changes.