DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific DeFi smart contract vulnerabilities, formatted for inclusion in a professional security audit report. Each entry includes the Vulnerability Type, Specific Mechanism, Impact, and Recommended Mitigation.

---

1. Reentrancy in Compounder Contracts (Cross-Contract State Update)

Vulnerability Type: Reentrancy (CWE-693)

Severity: High

Location: Compounder.sol: withdrawPrinciple() and Compounder.sol: callback()

Description

The Compounder contract allows users to deposit assets into underlying protocols (e.g., Aave, Compound) and claim interest. The withdrawPrinciple() function is intended to exit the position and return the principal to the user. However, the contract calls an external onTokenReceived() callback to the user’s address before updating the internal userBalances[msg.sender] mapping to zero.

solid