DeFi Smart Contract Vulnerabilities Audit Guide

Here are three specific DeFi smart contract vulnerabilities commonly identified in security audits, described with technical precision suitable for an audit report:

1. Price Oracle Manipulation via Flash Loans

Severity: Critical

CWE: CWE-20: Improper Input Validation; CWE-119: Memory Buffer Overflow (indirect)

Description:

The smart contract relies on a spot price from a decentralized exchange (e.g., DEX) to determine the value of assets in a lending or lending market. An attacker can exploit a flash loan (a large, temporary loan repaid within the same transaction) to drastically manipulate the spot price by buying or selling large amounts of the target token. Since the price reverts after the flash loan is repaid, the manipulation is temporary but sufficient to trick the contract into issuing excessive collateral or allowing an under-collateralized borrow.

Example Vulnerable Code Pattern:

solidity
function getAssetPrice(address token