Vulnerabilities
List of Common Solidity Smart Contract Vulnerabilities
Reentrancy (ERC721, ERC1155, ERC777)
Sandwich attacks (front-running/back-running)
Flash loan attacks (oracle manipulation)
Block stuffing
DoS with revert or infinite gas consumption
DoS due to Underflow
Metamorphic contracts (bytecode mutation)
Signature replay attacks
Short address attacks (Solidity <0.5.0)
Token approval Griefing
Unexpected non-zero ether balance (self-destruct)
Calls to arbitrary contracts
Every address can accept ether leads to DoS
Force-feeding attacks
Weak on-chain randomness (prevrandao)
Unbounded loops (pagination)
Unbounded gas consumption by returning a lot of data
Default Enum values
Duplicate array elements
Hash collisions with dynamic types (packed ABI encoding)
Storage collisions with delegate call
Function selector collisions (zero selectors)
Wrong inheritance order
Strict Equalities DoS
Integer overflow/underflow (Solidity <0.8.0)
Lack of precision in calculations
Access control via tx.origin
Problems with ERC20 decimals
Mis-initialization of contracts (ownership/proxy)
Private key leaks in .env files
Directional character (U+202E) usage (Solidity <0.7.6)
Compiler bugs
Price Oracle Manipulation
Unlimited Token allowance
Lack of Access Controls
Asserting contract from Code Size
Delegate call to Untrusted Callee
Unsafe Typecast
Write to Arbitrary storage collision
Insufficient User-Input Validation
Unchecked return value
Message call with hard-coded gas
Short Address attack
Divide before multiplying
Unsafe Ownership transfer
Improper Array Deletion
Dirty High Order Bits
Floating Point Arithmetic
Unexpected Ether Leading to DoS
Use of deprecated solidity Functions
Check for Gas Optimizations
Forcefully Send Ether with Selfdestruct
Hidden malicious code
Honeypots
On-chain & off-chain data handling
Ineffective key-management
Transaction order manipulation
Governance-related vulnerabilities
Incorrect Integration
Vulnerable Rebalancing/Buyback Mechanics
Faulty Native Token handling
Serialization/Parsing Issues
Naive Trust Assumptions
Uninitialized Proxies
Reinitialization Vulnerability
Incorrect Special Character Handling
Botched Upgrades
Governance Takeovers
Flawed Math
Transaction Replay Attack
Logic Errors
Exploiting Approvals
Gas Siphoning
UI Issues
Check for Business Logic Vulnerabilities
Check for correct inheritance
Check if the spot price from an AMM as an oracle is used
Check for tokens that use too many or too few decimals
Check if internal accounting is mixed with actual balances
Check if the Contract approves tokens before transferFrom to avoid revert
Check if state variable layout is followed when using delegate-call in proxy contracts
Check if events are emitted on critical functions
Last updated