Here are three specific DeFi smart contract vulnerabilities commonly identified in professional security audits, described with technical precision suitable for an audit report:
1. Reentrancy in Token Balances (ERC-777/ERC-721 Callbacks)
CWE: 841 (Improper Enforcement of Behavioral Workflow)
Severity: High
Description:
This vulnerability occurs when a smart contract calls an external token contract that executes a callback function to the original contract before the state variables are updated. Unlike classic ERC-20 reentrancy (where balanceOf is read after external calls), this variant exploits tokens that implement callback mechanisms (e.g., ERC-777’s tokensReceived or ERC-721’s onERC721Received).
Specific Scenario:
A vault contract receives ERC-777 tokens. The contract calls token.transferFrom(user, address(this), amount). During the
Top comments (0)