Here are three specific DeFi smart contract vulnerabilities, described in a format suitable for an audit report. Each entry includes the Vulnerability Class, a Concrete Scenario, Impact, and Remediation.
1. Re-entrancy in Cross-Protocol Interaction (CWE-841)
Description:
A re-entrancy vulnerability occurs when a smart contract makes an external call to an untrusted or partially trusted contract before completing state changes. In DeFi, this is especially dangerous when protocols interact (e.g., a lending protocol calling a price oracle or another lending market). An attacker can recursively re-enter the function via the external call, manipulating state before the initial transaction completes.
Specific Scenario:
A lending protocol (Lender.sol) allows users to withdraw collateral. The withdraw() function:
- Calculates the user’s collateral balance.
- Transfers ETH to the user via `call{value:
Top comments (0)