Vulnerabilities & PoC
The Most Common Smart Contract Vulnerabilities (Reentrancy, Oracles & Access Control)
LOZULA Lead Vulnerability Researcher
2025-12-16
11 min read
Key Takeaways for Security Teams
- Never execute external calls before updating internal contract balances.
- Automate invariant testing using Foundry fuzzing suites.
Technical breakdown of the top exploit vectors in EVM smart contracts: reentrancy, oracle price manipulation, uninitialized proxies, and access control bypasses.
1. Reentrancy & Cross-Function Reentrancy
Reentrancy occurs when an external call is made before state changes are resolved. Cross-function reentrancy occurs when two functions share state and one can be reentered while the other is executing.
- •Always use the Checks-Effects-Interactions (CEI) design pattern.
- •Implement OpenZeppelin ReentrancyGuard nonReentrant modifier.
- •Be cautious with ERC-777 and ERC-1155 tokens that execute recipient hooks.
2. Oracle Manipulation & Spot Price Exploits
Using spot DEX pool reserves (e.g., Uniswap v2 pair balances) as price oracles allows flash loan attackers to artificially manipulate prices within a single transaction.
- •Use decentralized Chainlink Data Feeds or Uniswap v3 TWAP oracles.
- •Never rely on instant getReserves() balances for collateral valuation.