Common DeFi Exploit Patterns
DeFi has lost over $3.8 billion to smart contract exploits. Most of it falls into five categories. Below is the complete taxonomy — how each attack works, real-world examples, and interactive simulations showing the mechanics.
🔄 Attack Flow Diagram — Reentrancy
Watch the attack sequence unfold. Each step highlights the vulnerable code pattern.
💻 Vulnerable vs Secure Code Patterns
💰 Interactive: $ Value at Risk by Vulnerability Type
Drag the slider to model how a $1M position would be impacted by each attack type. Shows potential loss, recovery probability, and time to recover.
📅 Notable Incidents by Attack Type
🛡️ Protection Checklist for Each Attack Type
🔄 Reentrancy Defense
⚡ Flash Loan Defense
📊 Oracle Defense
🔑 Access Control Defense
🔬 DeFi Security Prevention Framework
The industry standard for securing any DeFi protocol.
Architecture Review
Map all external call paths. Identify cross-contract dependencies. Model attacker capabilities. Assume every external contract is malicious.
CEI Pattern Enforcement
Enforce Check-Effects-Interactions on every function. No external call before state updates. Use modifiers for reentrancy guards. Automate via static analysis tools like Slither.
Fuzzing & Invariant Testing
Run invariant tests that enforce state constraints across thousands of random transactions. Echidna and Foundry's InvariantRunner are industry standard. Find edge cases your unit tests missed.
Timelock & Escape Hatches
Every critical upgrade must have a timelock (48h–14d). Users need time to exit if a suspicious upgrade is announced. Emergency pause functions must be accessible but not easily abused.
Oracle Diversification
Never rely on a single price source. Use 3+ independent oracles with different data aggregation methods. TWAP windows should be long enough to prevent flash manipulation.
Formal Verification
Mathematically prove contract correctness. Certora, Runtime Verification, and Trail of Bits all offer formal verification services. Expensive but critical for protocols holding >$100M.