Blockchain: smart contract security

Vulnerability categories

Logic that fails to restrict who can call privileged functions (e.g. a missing onlyOwner check)

A contract calls an external contract before updating its own state, letting the callee re-enter and drain funds (the classic DAO hack)

Contracts trust external data feeds; manipulating the feed (e.g. a faked price) breaks the contract’s assumptions

Pending transactions sit in the mempool, so bots and miners can observe and reorder them (e.g. buying before a known large trade)

Logic relying on block.timestamp, which miners can influence within a window

Integer overflows and underflows (unchecked arithmetic) producing unexpected balances

Unexpected reverts or exhausting the block gas limit make a contract unusable

Forcing Ether into a contract (e.g. via selfdestruct or coinbase) to break balance-dependent logic