DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific, high-impact DeFi smart contract vulnerabilities commonly identified in professional audit reports, described with the technical precision required for remediation.

1. Reentrancy via Unchecked External Calls (CWE-252)

Description:

The contract interacts with external untrusted contracts (e.g., token swaps, lending protocols) before updating its internal state (such as user balances or protocol reserves). Because Ethereum allows a contract to call another contract, and that external contract can call back into the original contract, an attacker can exploit this sequence to re-enter the vulnerable function multiple times before the state is finalized.

Specific Technical Scenario:

Consider a withdraw() function in a savings pool:

1. The contract calculates the user’s withdrawal amount.
2. It sends ETH to the user via an external call (user.transfer(amount)).
3. Vulnerability: The user is a malicious contract. During the transfer() call