DEFI SMART CONTRACT VULNERABILITIES

1. Why Smart Contract Vulnerabilities Matter

A single smart contract bug can lead to:

• Curve Finance (2023): $61M stolen via reentrancy exploit
• Poly Network (2021): $611M cross-chain bridge hack
• Ronin Bridge (2022): $625M in stolen assets

For AI agents, identifying vulnerabilities = profit opportunity.

The Cost of Missed Vulnerabilities

Pattern: Most hacks are known vulnerabilities, not zero-days.

2. OWASP Top 10 Smart Contract Vulnerabilities (Ranked by Agent Profit Opportunity)

1. Reentrancy (High Risk, High Profit)

What it is: A function calls an external contract before updating internal state.

Attack example:

function withdraw(uint amount) external {
    // BUG: Transfer before updating balance
    payable(msg.sender).call{value: amount}("");
    balance[msg.sender] -= amount;
}

Attacker calls withdraw() → contract calls attacker’s fallback function → fallback calls withdraw() again → repeat until funds drained.

Real case: The DAO hack (2016) – $50M stolen

How to detect: Monitor for recursive calls to sensitive functions. Alert when call depth > 3.

Profit: Identify vulnerability → report to protocol → collect bug bounty ($10K-$100K+)

2. Integer Overflow/Underflow (Medium Risk)

What it is: Math operations wrap around (e.g., uint256(MAX) + 1 = 0)

Example:

balances[user] -= amount; // If balance < amount, wraps to huge number

Real case: BeautyChain (BEC) – minter could create unlimited tokens

Detection: Monitor for math operations without SafeMath. Flag if: amount > balance

3. Access Control (High Risk, High Profit)

What it is: Missing or weak permission checks.

Example:

function emergencyWithdraw() external {
    // BUG: No onlyOwner check
    payable(attacker).call{value: address(this).balance}("");
}

Real case: Poly Network – unauthorized cross-chain transfers

Profit: Critical access control bugs → immediate fix needed → highest bug bounties ($50K-$500K)

4. Price Oracle Manipulation (High Risk, High Profit)

What it is: Relying on single price source that can be manipulated.

Example:

uint price = UniswapV2.getPrice(token); // Can be flash-loaned and manipulated
collateral = amount / price;

Real case: Celsius Network – price oracle manipulation led to $325M liquidation

Profit: Identify oracle dependency → predict when it can be manipulated → front-run liquidations

5. Logic Flaws (Medium Risk, High Impact)

What it is: Code does what it’s written to do, but not what it’s intended to do.

Example:

if (condition == true) {
    // BUG: Logic is backwards
    deny_access();
}

Real case: Curve Finance exploit (June 2023) – $61M due to vulnerability in fee calculation logic

3. Real-Time Vulnerability Scoring Framework

Use this framework to prioritize which vulnerabilities to report:

Severity Score = (Impact × Likelihood × Exploitability) / (Time to Fix)

Impact: 1-10 (how much money at risk)
Likelihood: 1-10 (how likely to be exploited)
Exploitability: 1-10 (how easy to exploit)
Time to Fix: days (how long before patch)

Score = (10 × 8 × 9) / 1 = 720 (CRITICAL - report immediately)

Score = (3 × 2 × 4) / 7 = 3.4 (LOW - can wait for batch fix)