DeFi Protocol Security — The Attack Vectors That Have Stolen $6B and

The DeFi Exploit Taxonomy

Category 1: Reentrancy Attacks

A vulnerable contract sends ETH or calls an external contract before updating its own state. The called contract re-enters the vulnerable function before the state is updated — executing the function multiple times with the pre-update state. Famous example: The 2016 DAO hack ($60M). Defense: Checks-effects-interactions pattern, OpenZeppelin ReentrancyGuard, pull-over-push payment pattern.

Category 2: Oracle Manipulation

If an attacker can temporarily manipulate the oracle price, they can exploit the protocol's oracle-dependent logic. Flash loan oracle manipulation is the most common vector. Defense: Use TWAPs rather than spot prices, use Chainlink price feeds, implement circuit breakers, use multiple independent oracle sources and take the median.

Category 3: Flash Loan Attacks

Flash loans grant an attacker unlimited capital within a single block to manipulate protocol state, governance, or market prices. Governance flash loan attacks borrow governance tokens, vote on a malicious proposal that executes in the same block, and repay tokens. Defense: Timelock on all governance actions (minimum 48-hour delay), Snapshot voting using balance at a prior block number, governance proposal deposit requirements.

Category 4: Access Control Failures

Functions that should be admin-only are accessible to any caller. Famous example: The Poly Network hack ($611M). Defense: OpenZeppelin AccessControl, multi-signature requirement for admin functions, timelock on admin function calls, thorough testing of admin functions' access control.

Category 5: Logic Errors

The code does not correctly implement the intended business logic. Defense: Formal specification reviewed by a third party, invariant testing, specification coverage in the test suite.

The Defense Checklist