Here are three specific DeFi smart contract vulnerabilities often identified in audit reports, including their mechanics, impact, and mitigation strategies.
1. Reentrancy Vulnerability in Yield Aggregators
Description:
Reentrancy occurs when a smart contract calls an external contract that, in turn, calls back into the first contract before the first contract has finished its state updates. In DeFi yield aggregators (e.g., Aave, Compound integrators), this is critical because the contract often interacts with external lending protocols.
Specific Scenario:
A yield optimizer contract YieldOpt allows users to deposit ETH and stake it into Aave. The deposit() function:
- Transfers ETH from the user to
YieldOpt. - Calls
aave.supplyETH()to deposit into Aave. - Updates the user’s internal balance in
YieldOpt’s storage.
Vulnerability:
If
Top comments (0)