Here are three specific DeFi smart contract vulnerabilities commonly identified in professional security audits, described with technical precision suitable for an audit report.
1. Price Oracle Manipulation via Low-Liquidity Pools
CWE: CWE-20 (Improper Input Validation) / CWE-345 (Insufficient Verification of Data Authenticity)
Description:
The smart contract directly retrieves asset prices from a decentralized exchange (DEX) pool (e.g., Uniswap V2/V3, Curve) using a single getReserves() call without employing a time-weighted average price (TWAP) or a reputable off-chain oracle (e.g., Chainlink, Pyth).
Vulnerability Mechanism:
- Flash Loan Attack: An attacker acquires a large flash loan, executes a series of trades to artificially skew the price of an asset in the low-liquidity pool, and then uses the manipulated price to borrow or mint assets at
Top comments (0)