10 Most Common Smart Contract Vulnerabilities — With Code Examples

1. Reentrancy

Before all state updates, an external call allows the callee to call back into the function. Classic: withdraw() calls the user before zeroing the balance — user re-enters withdraw() repeatedly.

Prevention: OpenZeppelin ReentrancyGuard. CEI (Checks-Effects-Interactions) pattern.

2. Integer Overflow/Underflow

Pre-Solidity 0.8: arithmetic wraps silently. 255 + 1 = 0 for uint8. `unchecked` blocks in 0.8+: still vulnerable.

Prevention: Use Solidity 0.8+. Avoid `unchecked` for user-controlled values.

3. Access Control (Missing Modifier)

`function mint(address to, uint256 amount) external { _mint(to, amount); }` — anyone can mint.

Prevention: OpenZeppelin Ownable, AccessControl. Every privileged function needs a modifier.

4. Oracle Manipulation

Reading spot price from a single DEX — flash loan can manipulate it within one transaction.

Prevention: TWAP oracles, Chainlink + TWAP dual-oracle.

5. Flash Loan Attacks

Borrowing uncollateralized capital to amplify attack: manipulate oracle, exploit governance, drain lending pool.

Prevention: Require multi-block consistency for price-sensitive operations. Flash loan-proof design.

6. Unchecked External Call Returns

`addr.call{value: amount}(""); // Return value ignored` If the call fails silently, the state has already been updated.

Prevention: Always check return value: `(bool success,) = addr.call{...}(...); require(success);`

7. Delegatecall to Untrusted Contract

In proxy patterns: if the implementation address can be set by untrusted parties, they can execute arbitrary code in the proxy's storage context.

Prevention: Strict access control on upgradeability. Never delegatecall to user-supplied addresses.

8. Griefing (Gas Limit DoS)

A function iterates over an unbounded array. Attacker fills the array with 10,000 elements. The function now costs more gas than the block limit: permanently unusable.

Prevention: Limit array growth. Use pagination for large iterations. Pull-over-push pattern.

9. Front-Running

Attacker observes pending transaction in mempool, inserts their own transaction with higher gas to execute first. DEX sandwich attacks are the canonical example.

Prevention: Commit-reveal scheme. Flashbots bundles. Slippage limits. Private mempool.

10. Price Impact Manipulation (ERC-777 / Callback Issues)

ERC-777 tokens have a transfer hook that calls the recipient before updating balances. Protocols that integrated ERC-777 as if it were ERC-20 were vulnerable to reentrancy via the hook.

Prevention: Use ERC-20 only in DeFi. Treat any external call as a potential reentrancy vector.