DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific DeFi smart contract vulnerabilities commonly identified in audit reports, described with technical precision for inclusion in a professional security assessment.

1. Reentrancy via External Calls in State-Modifying Functions

CWE-841: Improper Enforcement of Behavioral Workflow

• Description: A function that modifies internal state (e.g., token balances, user positions) makes an external call to an untrusted contract before updating the state variables. If the external contract is malicious, it can re-enter the vulnerable function during the external call, exploiting the stale state to drain funds or manipulate logic.
• Specific Example:

solidity
    function withdraw(uint256 amount) external {
        require(balances[msg.sender] >= amount, "Insufficient balance");
        // VULNERABILITY: External call before state update
        (bool success, ) = msg.sender.call{value: amount