Here are three specific, high-impact DeFi smart contract vulnerabilities commonly identified in professional audit reports, described with the technical precision required for remediation.
1. Reentrancy via Unchecked External Calls (CWE-252)
Description:
The contract interacts with external untrusted contracts (e.g., token swaps, lending protocols) before updating its internal state (such as user balances or protocol reserves). Because Ethereum allows a contract to call another contract, and that external contract can call back into the original contract, an attacker can exploit this sequence to re-enter the vulnerable function multiple times before the state is finalized.
Specific Technical Scenario:
Consider a withdraw() function in a savings pool:
- The contract calculates the user’s withdrawal amount.
- It sends ETH to the user via an external call (
user.transfer(amount)). -
Vulnerability: The user is a malicious contract. During the
transfer()call
Top comments (0)