Blockchain DeFi Security Glossary — 40 Security Terms Every Developer Must Know

Access Control Vulnerability

A smart contract flaw where unauthorized addresses can call privileged functions. The most common DeFi exploit category. Prevention: rigorous role-based access control using OpenZeppelin's AccessControl or Ownable.

Approval Phishing

A social engineering attack where users are tricked into calling `approve(attacker, MaxUint256)` on a legitimate token contract. The attacker then drains the user's balance via `transferFrom`. Prevention: user education; frontends displaying clear approval warnings.

Arbitrary External Call

A smart contract that forwards arbitrary calldata to arbitrary addresses. If an attacker controls the target and calldata, they can drain the contract. Critical vulnerability class in multi-call contracts.

Assumption Violation

A vulnerability arising when code assumes properties that the underlying system doesn't guarantee. Example: assuming `msg.sender` in a meta-transaction system is the actual user (it's the relayer). Prevention: careful assumption documentation and testing.

Attack Surface

All the code paths, external dependencies, and inputs that could potentially be exploited. Reducing attack surface (fewer external calls, simpler logic, fewer admin functions) reduces risk.

Bad Debt

In lending protocols: positions where the collateral value falls below the debt value, making them unprofitable to liquidate. Bad debt accumulates on the protocol. Mitigation: aggressive liquidation parameters, insurance fund.

Block Stuffing

A DoS attack where an attacker fills blocks with high-fee transactions to prevent legitimate transactions from being included. Relevant for time-sensitive protocols (Dutch auctions, expiring options).

Broken Access Control

OWASP's #1 web vulnerability — same in smart contracts. Functions that should be restricted are callable by anyone. Example: a `mint()` function without an `onlyOwner` modifier.

Centralization Risk

The degree to which a single key or entity can change protocol behavior. Admin keys that can pause, upgrade, or drain a protocol are centralization risks. Mitigations: multi-sig, timelocks, DAO governance.

Code Reuse Risk

Copy-pasting code from another protocol without understanding its assumptions and context. The context may be different in your protocol, making the copied code unsafe.

Composite Attack

An exploit combining multiple vulnerabilities that are each harmless alone. Example: a small rounding error (harmless alone) combined with flash loans (amplifies the rounding by 1000x) becomes a drain attack.

DELEGATECALL Risk

A smart contract that allows arbitrary delegatecall to attacker-controlled addresses. Allows the attacker to execute arbitrary code in the calling contract's storage context. Proxy vulnerabilities often involve delegatecall to malicious implementations.

Denial of Service (Gas)

Making a function permanently uncallable by forcing it to use more gas than the block gas limit. Unbounded loops over arrays that can grow indefinitely are the most common pattern.

Double Spend

Spending the same tokens twice by exploiting a reentrancy vulnerability, flash loan attack, or cross-chain inconsistency.

Emergency Contact

The designated individual or system to contact if an exploit is detected. Every serious protocol has an emergency contact plan before launch — who to call at 2am, what to do first (pause?), who can authorize emergency actions.

ETH Transfer Failure

`address.transfer()` reverts if the recipient is a contract that reverts in its fallback. Use `.call{value:}()` and check the return value instead.

Exchange Rate Manipulation

Manipulating a protocol's internal exchange rate (e.g., share price in ERC-4626 vaults) to drain funds. Prevention: internal exchange rates should never rely on external spot prices.

Flash Mint

Minting tokens temporarily within a single transaction (if the contract allows it). Similar to flash loans but for tokens. Can amplify governance attacks if voting is based on token balance without historical snapshot.

Force ETH

Sending ETH to a contract that doesn't have a payable receive function. Methods: `selfdestruct` (deprecated), mining rewards to a contract address. Contracts that rely on `address(this).balance == 0` for invariants are vulnerable.

Front-Running

A miner or searcher observing a pending transaction and inserting their own transaction before it to profit. Examples: DEX sandwich attacks, NFT mint sniping, liquidation front-running.

Governance Attack

Acquiring enough governance tokens (through flash loans or accumulation) to pass malicious proposals. Prevention: historical balance snapshots (ERC20Votes), timelocks between proposal and execution, quorum requirements.

Hard-Coded Addresses

Embedding contract addresses (oracle, token, DEX) directly in code without upgrade mechanism. If the upstream contract changes, the protocol breaks and cannot adapt.

Improper Input Validation

Not checking that inputs are within valid ranges before processing. Example: allowing a fee parameter to be set to 10000 (100%) which would drain user funds.

Incentive Misalignment

Protocol economics that reward behavior that harms the protocol. Example: liquidation bonuses so high that liquidators game healthy positions to force liquidation.

Inflation Attack (ERC-4626)

The vault inflation attack: if a vault has 0 shares outstanding, a malicious user can make the first deposit then donate assets to inflate the share price, causing subsequent depositors to receive 0 shares due to rounding. Mitigation: minimum initial deposit, dead shares.

Integer Underflow

Subtracting from a number below 0, causing it to wrap to MaxUint. Solidity 0.8+ handles this (reverts). In `unchecked` blocks: still a risk.

Invariant Break

A state where a fundamental protocol guarantee is violated. 'Total shares times share price always equals total assets' — if broken, someone gets more than they should.

Key Compromise

An attacker gains access to a privileged private key (admin key, oracle signing key). Multi-sig and HSMs reduce this risk. Key compromise is the #1 cause of DeFi protocol admin key incidents.

Liquidity Risk

Protocol cannot process withdrawals because assets are deployed in illiquid strategies. Withdrawal queues and liquidity buffers address this.

Logic Error

A vulnerability in the business logic of a contract that allows unintended behavior. The most common type of DeFi exploit — audit-resistant because it requires understanding the intended behavior, not just code patterns.

Low-Level Calls

`call()`, `delegatecall()`, `staticcall()` — return false on failure rather than reverting. Every low-level call result must be checked.

Manipulable Randomness

Using `block.timestamp`, `block.prevrandao`, or `blockhash` as randomness sources. Miners/validators can manipulate these within certain bounds. Use Chainlink VRF for any randomness that has economic value.

MEV Extraction

Value extracted by reordering or inserting transactions. Not always an attack — MEV is a feature of EVM design. But protocols that assume fair ordering are vulnerable to MEV-enabled exploits.