Here are three specific DeFi smart contract vulnerabilities suitable for inclusion in an audit report, formatted with technical precision and standard industry classification.
1. Reentrancy in External Call Before State Update (CWE-841)
Severity: Critical
CWE ID: CWE-841 (Improper Enforcement of Behavioral Workflow)
Affected Pattern: AMM Token Swap Functions, Lending Protocol Withdrawals
Description:
The contract performs an external call to an untrusted address (e.g., token.transfer()) before updating internal state variables (e.g., balances[addr] or totalSupply). An attacker can deploy a malicious contract that, upon receiving the token, re-invokes the vulnerable function before the state update completes, allowing repeated withdrawals of the same funds.
Example Vulnerable Code:
solidity
function withdraw(uint256 amount) external {
require(balances[msg.sender]
Top comments (0)