Smart Contract Hackpedia
The endless array of smart contract vulnerabilities - Top 250
Smart contracts are inherently insecure and pose major risks to any web3 project.
This list is non-exhaustive and the most common 250 security vulnerabilities
we observe during smart contract audits performed.
This list is continuously updated with new threat vectors once identified and validated.
- Super User Account or Privilege Management
- Reentrancy vulnerabilities
- Oracle manipulation
- Flash loan attacks
- Blacklisting and Burning Functions
- Contract Logic or Asset Configuration can be arbitrarily changes
- Self-Destruct Functions
- Minting Functions
- Rolling Your Own Crypto and Unique Contract Logic
- Unauthorized Transfers
- Incorrect Signature Implementation or Arithmetic
- Untrusted Control Flow
- Transaction Order Dependence
- Modifying storage array by value
- Incorrect Parameter order in a shift instruction
- Contract name reused
- Public mappings with nested variables
- Right-To-Left-Override control character is used
- State variables shadowing
- Functions allowing anyone to destruct the contract
- Uninitialized state variables
- Uninitialized storage variables
- Insecure Symbolic Trace
- Unrestricted flaw in Transferproxy
- Intra-function reentrancy vulnerability
- Cross-function reentrancy vulnerability
- Arithmetic vulnerability
- Malicious use of REVERT, INVALID, SELFDESTRUCT, RETURN, or STOP functions
- Unprotected upgradeable contract
- Functions that send Ether to arbitrary destination
- Tainted array length assignment
- Controlled delegatecall destination
- Signed storage integer array compiler bug
- Unchecked tokens transfer
- Weak PRNG
- Detect dangerous Enum conversion
- Incorrect ERC20 interfaces
- Incorrect ERC721 interfaces
- Dangerous strict equalities
- Contracts that lock ether
- Deletion on mapping containing a structure
- State variables shadowing from abstract contracts
- Tautology or contradiction
- Unused write
- Misuse of Boolean constant
- Constant functions using assembly code
- Constant functions changing the state
- Imprecise arithmetic operations order
- Reused base constructor
- Dangerous usage of tx.origin
- Unchecked low-level calls
- Unchecked send
- Uninitialized local variables
- Unused return values
- Modifiers that can return the default value
- Built-in symbol shadowing; Local variables shadowing
- Uninitialized function pointer calls in constructors
- Local variables used prior their declaration
- Constructor called not implemented
- Multiple calls in a loop
- Missing Events Access Control
- Missing Events Arithmetic
- Dangerous unary expressions
- Missing Zero Address Validation
- Benign reentrancy vulnerabilities
- Reentrancy vulnerabilities leading to out-of-order Events
- Dangerous usage of block.timestamp
- Assembly usage
- Assert state change
- Comparison to boolean constant
- Deprecated Solidity Standards
- Un-indexed ERC20 event parameters
- Function initializing state variables
- Low level calls
- Missing inheritance
- Conformity to Solidity naming conventions
- If different pragma directives are used
- Redundant statements
- Incorrect Solidity version
- Unimplemented functions
- Unused state variables
- Costly operations in a loop
- Functions that are not used
- Reentrancy vulnerabilities through send and transfer
- Variable names are too similar
- Conformance to numeric notation best practices
- State variables that could be declared constant
- Public function that could be declared externally.
- Assert Violation
- Integer Overflow and Underflow
- Arbitrary Jump with Function Type Variable
- Write to Arbitrary Storage Location
- Uninitialized Storage Pointer
- Outdated Compiler Version
- Floating Pragma – Unchecked Call Return Value
- Unprotected Ether Withdrawal
- Unprotected SELFDESTRUCT Instruction
- Reentrancy – State Variable Default Visibility
- Uninitialized Storage Pointer
- Use of Deprecated Solidity Functions
- Delegatecall to Untrusted Callee
- DoS with Failed Call
- Authorization through tx.origin
- Block values as a proxy for time
- Incorrect Constructor Name
- Shadowing State Variables
- Weak Sources of Randomness from Chain Attributes
- Requirement Violation
- Write to Arbitrary Storage Location
- DoS With Block Gas Limit
- Typographical Error
- Unencrypted Private Data On-Chain
- Code With No Effects
- Message call with hardcoded gas amount
- Typographical Error
- DoS With Block Gas Limit
- Presence of unused variables
- Incorrect Inheritance Order
- Requirement Violation
- Weak Sources of Randomness from Chain Attributes
- Shadowing State Variables
- Loss of user funds staked (principal) by freezing or theft
- Incorrect accounting logic in the core protocol
- Theft of unclaimed yield
- Unable to shut down the protocol in the global settlement process
- Freezing of unclaimed yield
- Temporary freezing of funds for at least 24 hours
- Unable to call smart contracts
- Smart contract fails to deliver promised returns
- Incorrect data supplied by third party oracles
- Oracle manipulation
- Flash loan attacks
- Basic economic governance attacks (e.g., 51% attack)
- Lack of liquidity
- Best practice critiques
- Sybil attacks
- Centralization risks
- Flash loan attacks
- Running out of gas
- Block stuffing
- Susceptibility to frontrunning
- Signature malleability
- Susceptibility to replay attacks
- Weak randomness
- Weak encryption
- Unverified contract
- Unlimited minting to a malicious destination
- Infinite token supply
- Dangerous token migration
- Pausing token transfers anytime for unlimited period
- Pausing token transfer for limited period (defined in the contract)
- Pausing funds withdrawals (Centralized pausing for any funds withdrawals)
- Pausing funds withdrawals with emergency withdrawal available
- Proxy patterns
- Funds lock with centralized control
- Unfair token distribution: high % of team rewards suspicious functions
- Insufficient time lock for important contract changes Overprivileged EOA-contract-owner
- The owner can call a function that allows to withdraw all staked in the contract funds to a needed address.
- The owner can change address of token reward distribution.
- The owner can change location of staked user funds)
- Unrestricted fee setting
- withdrawal fee can be set up to 100%.
- user reward fee can be decreased.
- Team reward increased without any limitations in centralized way.
- Other protocol fees with unexpected security consequences)
- Using a singular exchange as a price source.
- Unverified contracts unlimited minting to a malicious destination
- Dangerous token migration
- Pausing token transfers any time for unlimited period
- Pausing token transfer for limited period (defined in the contract)
- Pausing funds withdrawals (centralized pausing for any funds withdrawals)
- Pausing funds withdrawals with emergency withdrawal available
- Funds lock with centralized control.
- Compiler errors.
- Race conditions and Reentrancy.
- Cross-function race conditions.
- Possible delays in data delivery.
- Vulnerable Oracle calls.
- Front running.
- Timestamp dependence.
- Integer Overflow and Underflow.
- DoS with Revert.
- DoS with block gas limit.
- Methods execution permissions.
- Economy model of the contract.
- The impact of the exchange rate on the logic.
- Private user data leaks.
- Malicious Event log.
- Scoping and Declarations.
- Uninitialized storage pointers.
- Arithmetic accuracy.
- Design Logic.
- Cross-function race conditions.
- Safe Open Zeppelin contracts implementation and usage.
- Fallback function security.
- Infinite Mint Glitch
- Integer Division
- Integer Overflow and Underflow
- Integer signedness error
- Integer Truncation
- Symbolic Attack
- Wrong Operator
- Hidden built-in symbols
- Hidden state variables
- Wrong inheritance order
- Uninitialized Local/state Variables
- Uninitialized storage variable
- Right-To-Left-Override control character (U+202E)
- Delete Dynamic Array Elements:
- Using continue-statements in do-while-statements
- Reentrancy Vulnerability
- Unhandled Exception
- Forced accept ethers
- Locked money (ether)
- Pre-sent ether
- Hash Collisions with Multiple Variable Length Arguments
- Short address attack
- Signature with wrong parameter
- The call address or data are externally controlled
- Non-standard token interface
- Any type of specified function variable
- Use assembly code return in the constructor
- Complex fallback function
- DOS by gaslimit
- DOS by non-existent address or contract
- Results of contract execution affected by miners
- Transaction order dependence
- Storage overlap attack
- Invariant in loop
- Invariant is not declared constant
- Unused public functions within a contract should be declared external
- Excessive Gas Fee Consumption – Incorrect use of byte[]
- Replay attack
- Suicidal contract
- origin for authentication
- Wasteful contract
- Write the wrong constructor’s name
- Non-public variables are accessed by public or external function
- Public data
- Implicit visibility level
- Non-standard naming
- Unlimited compiler versions
- Use deprecated built-in symbols
- Too many digits
- Change the contract status in the view or constant function
- Improper use of require, assert, and revert
- Indirect execution of unknown code
- Using the blockhash function
- Incorrect calculation of the output token amount
- Vulnerable to Fuzzing Attacks
