The 10 Most Common Smart Contract Vulnerabilities

Smart contract vulnerabilities cost the industry billions each year. This taxonomy covers the 10 most common vulnerability classes with technical explanations and real-world examples.

1. Reentrancy

The most famous vulnerability. A malicious contract re-enters a function before state is updated, allowing repeated withdrawals. The DAO hack ($60M) is the canonical example. Prevention: Checks-Effects-Interactions pattern, ReentrancyGuard.

2. Access Control Errors

Missing or incorrect function visibility modifiers, or relying on msg.sender without properly validating the role. Poly Network ($610M) lost funds because an admin function lacked adequate multi-sig protection. Prevention: OpenZeppelin AccessControl, proper modifier design.

3. Integer Overflow/Underflow

Pre-Solidity 0.8, arithmetic could silently wrap around. SafeMath was the solution; now the compiler handles it automatically unless you use unchecked blocks. Prevention: Avoid unchecked arithmetic unless you've proven it safe.

4. Oracle Manipulation

Using AMM spot prices for price-sensitive operations allows flash loan attacks. An attacker can temporarily manipulate the spot price within a single transaction. Prevention: Use Chainlink or TWAP oracles for all price-sensitive operations.

5. Flash Loan Attacks

Attackers borrow huge capital with no collateral within a single transaction. Used to manipulate prices, vote in governance, and exploit logic bugs. Not a vulnerability by itself — it's an amplifier that makes other vulnerabilities more devastating. Prevention: Design protocols that are safe regardless of capital size.

6. Front-Running

Validators and MEV bots can observe pending transactions and insert their own transactions ahead of them. Particularly damaging for DEX trades, NFT mints, and auctions. Prevention: Commit-reveal schemes, MEV-resistant RPCs, slippage limits.

7. Denial of Service

Blocking critical functions by forcing reverts. If a contract sends ETH to all participants in a loop and one recipient's fallback reverts, the entire function fails. Prevention: Pull-over-push pattern, bounded loops, careful external call handling.

8. Logic Errors

Bugs in the business logic itself — not a known vulnerability pattern, but a correctness failure. Euler Finance's $197M hack exploited a logic error in the health factor calculation. Prevention: Formal specification, comprehensive unit and integration testing, multiple independent audits.

9. Unsafe Delegatecall

Delegatecall runs external code in the caller's context. If the storage layout of the proxy and implementation don't match, storage is silently corrupted. Proxy upgrade vulnerabilities have caused significant losses. Prevention: EIP-1967 storage slots, careful storage layout management.

10. Timestamp and Block Manipulation

Validators can manipulate block.timestamp within a small window. Contracts that rely on precise timestamps for state changes are vulnerable. block.difficulty (now PREVRANDAO) is manipulable by validators. Prevention: Use Chainlink VRF for verifiable randomness; avoid timestamp-critical logic.