DeFi Smart Contract Vulnerabilities Audit Guide

Here are three of the most common and critical smart contract vulnerabilities in DeFi, along with specific methods for detecting them during code review or automated analysis.

1. Reentrancy Vulnerability

Description:

Reentrancy occurs when a contract calls an external contract (e.g., via transfer() or call{value: ...}()) before updating its internal state. An attacker can exploit this by making a recursive call back into the vulnerable function before the state is updated, allowing them to drain funds or manipulate state multiple times within a single transaction.

How to Detect It:

• Code Review Pattern: Look for the "Check-Effect-Interaction" pattern violation. Specifically, check if any function that sends Ether or calls an external contract performs state updates after the external call.
  • ❌ Vulnerable:

solidity
    function withdraw() public {
        uint256 amount = balances[msg.sender];