Most DeFi hacks aren't sophisticated. They exploit the same handful of patterns that developers keep repeating. Here are the five vulnerability classes responsible for the majority of losses — and the one-line fixes for each.

1. Reentrancy (Still)

Yes, reentrancy is still draining contracts. The Checks-Effects-Interactions pattern has been known since 2016, yet developers continue writing external calls before state updates.

// VULNERABLE
function withdraw(uint amount) external {
    require(balances[msg.sender] >= amount);
    (bool success, ) = msg.sender.call{value: amount}("");
    balances[msg.sender] -= amount; // too late
}

// FIXED
function withdraw(uint amount) external {
    require(balances[msg.sender] >= amount);
    balances[msg.sender] -= amount; // state first
    (bool success, ) = msg.sender.call{value: amount}("");
}

2. Oracle Manipulation

Price oracles that use spot prices from a single DEX pool are trivially manipulable via flash loans. If your protocol reads getReserves() from a Uniswap pair and calculates price inline, you're one flash loan away from insolvency.

Fix: Use time-weighted average prices (TWAPs) or Chainlink feeds with staleness checks and circuit breakers.

3. Access Control Gaps

onlyOwner on admin functions is table stakes. The real bugs live in initialization functions that can be called twice, missing access checks on internal functions exposed through proxies, and role-based systems where privilege escalation paths exist.

Fix: Use OpenZeppelin's AccessControl with explicit role separation. Audit every external and public function for authorization.

4. Integer Edge Cases in Solidity 0.8+

Solidity 0.8 added overflow protection, but unchecked blocks reintroduce the risk. Developers use them for gas optimization without analyzing whether overflow is actually impossible in context. Division-before-multiplication precision loss is another silent killer.

Fix: Only use unchecked when you can mathematically prove the operation cannot overflow.

5. Cross-Contract Composability Risks

DeFi's composability is its superpower and its attack surface. Protocols that integrate with external contracts rarely validate return values, handle reentrancy across protocol boundaries, or account for tokens with non-standard behavior (rebasing, fee-on-transfer, ERC-777 hooks).

Fix: Never trust external contract return values. Implement explicit balance-checking patterns (balanceAfter - balanceBefore). Whitelist tokens.

---

These aren't edge cases — they're the bread and butter of smart contract security. If you're building on Ethereum and you can't identify all five in a code review, you're not ready to deploy to mainnet.

I teach the full methodology at ChainShield Academy — 25 lessons, hands-on Foundry labs, and a capstone audit with a professional certification. But the info above is free. Go audit your contracts today.

Welcome to ChainShield Academy. If you're here, you're serious about smart contract security. Good.

What You'll Get

The Smart Contract Security Masterclass is a 25-lesson, 6-module program that takes you from Solidity fundamentals to professional-grade auditing:

1. Security Foundations & The EVM — understand the machine before you hack it

2. Common Vulnerability Patterns — reentrancy, overflows, access control, DoS, MEV

3. Advanced Attack Vectors — proxies, signature exploits, composability risks

4. DeFi-Specific Security — oracles, AMMs, lending, bridges

5. Professional Auditing Methodology — Slither, Mythril, Echidna, manual review, report writing

6. Secure Development & Deployment — patterns, testing, deployment, and the capstone audit

The Capstone

Module 6 ends with a full protocol audit — 1,500 lines of intentionally vulnerable DeFi code with 8 planted bugs. Find them all, write professional PoC exploits in Foundry, submit your report, and earn the ChainShield Certified Smart Contract Auditor credential.

Community

Members get access to the Auditors Lounge — a private chat for discussing vulnerabilities, sharing audit findings, and connecting with other security researchers.

Every lesson includes hands-on Foundry labs. No theory-only fluff. You will write exploit code.

Let's build. 🛡️