⚠️ Common Vulnerabilities: Reentrancy & More

Beyond the big four (reentrancy, overflow, access control, front-running), production contracts face dozens of subtle vulnerabilities. Logic errors from incorrect assumptions. External call risks where malicious contracts manipulate your state. Gas-related attacks that lock contracts by hitting block limits. DoS vectors where griefers break core functionality. This section catalogs 14 common vulnerabilities with code examples, exploitation techniques, and fixes. Recognizing these patterns is the first step to writing secure contracts.

// ❌ Vulnerable
function claim() public {
  require(block.timestamp > deadline);
  // Miner can manipulate within 15s window
}

// ❌ Vulnerable
token.transfer(recipient, amount);
// If transfer fails, execution continues

// ❌ Vulnerable
function approve(uint amount) { allowance = amount; }
function transferFrom() { /* uses allowance */ }
// Attacker frontuns approve() to drain old + new allowance

// ❌ Vulnerable (Solidity <0.5)
function withdraw() { /* no visibility = public! */ }