smart-contract-vulnerabilities

A vulnerability playbook for auditing Solidity/EVM smart contracts, organized as an expert attack reference across the major smart-contract bug classes. It is intended for reviewing contracts for reentrancy, integer overflow/underflow, access-control flaws, unsafe delegatecall, weak on-chain randomness, flash-loan and MEV-related patterns, signature replay, and self-destruct/force-send issues. The material emphasizes subtle cases that base models tend to miss, such as cross-contract and read-only reentrancy and storage-layout collisions in proxy patterns.

Reentrancy is treated in depth: classic single-function, cross-function (two functions sharing state), cross-contract, and read-only reentrancy where a view function used by a third party for pricing returns stale intermediate state, illustrated with the Curve get_virtual_price example. Documented mitigations include Checks-Effects-Interactions, OpenZeppelin's ReentrancyGuard mutex, and pull-payment patterns. Other sections cover pre- and post-Solidity 0.8 arithmetic (silent wrapping versus unchecked blocks, SafeMath bypasses via casting and assembly), tx.origin versus msg.sender authentication, unprotected selfdestruct and delegatecall, predictable randomness sources such as block.timestamp and prevrandao, delegatecall storage-slot and function-selector collisions, sandwich and front-running defenses, and EIP-712/nonce signature-replay errors including cross-chain replay.

Use it when performing a security audit or threat assessment of on-chain code, when triaging a suspected exploit class, or as a checklist while writing or reviewing contracts. Each topic pairs the failure mechanism with concrete impact and defensive patterns, presented in tables and annotated call-flow diagrams. It also routes to related references, defi-attack-patterns for protocol-level exploits and deserialization-insecure for off-chain infrastructure, and points to an advanced SOLIDITY_VULN_PATTERNS.md companion with side-by-side vulnerable/fixed code, gas-optimization traps, and proxy storage-collision slot calculations. The content is descriptive and defense-oriented, mapping how each attack works so reviewers can recognize and close the corresponding gap.