AuditAI

Description

A vulnerability where a contract calls an external function that can call back into the original function, potentially leading to unexpected behavior and fund theft.

Vulnerable Code Example

function withdraw(uint256 amount) external {
    require(balances[msg.sender] >= amount);
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success);
    balances[msg.sender] -= amount;
}

Description

Using tx.origin for authorization allows phishing attacks, as tx.origin is the original sender of a transaction, not the immediate caller.

Vulnerable Code Example

function transferOwnership(address newOwner) public {
    require(tx.origin == owner);
    owner = newOwner;
}

Description

Arithmetic operations that exceed the range of the data type, causing unexpected behavior. Solidity 0.8.0+ includes built-in overflow checks.

Vulnerable Code Example

// In Solidity < 0.8.0
function transfer(address to, uint256 amount) external {
    balances[msg.sender] -= amount;
    balances[to] += amount;
}

Description

Functions that allow anyone to withdraw Ether from the contract without proper access controls.

Vulnerable Code Example

function withdrawFunds() public {
    msg.sender.transfer(address(this).balance);
}

Description

Using delegatecall to call functions from an address controlled by the user can lead to the execution of malicious code in the context of the calling contract.

Vulnerable Code Example

function delegateTransfer(address _to, uint256 _amount, address _impl) public {
    (bool success,) = _impl.delegatecall(
        abi.encodeWithSignature("transfer(address,uint256)", _to, _amount)
    );
    require(success);
}

Description

Failing to check the return value of a low-level call can lead to silent failures and unexpected behavior.

Vulnerable Code Example

function withdraw(uint256 amount) public {
    msg.sender.call{value: amount}("");
    balances[msg.sender] -= amount;
}

Description

Using a floating pragma (^0.8.0) allows contracts to be compiled with different compiler versions, which may introduce bugs or different behavior.

Vulnerable Code Example

pragma solidity ^0.8.0;

contract FloatingPragma {
    // Contract code
}

Description

Reading from storage multiple times when it could be cached in memory increases gas costs.

Vulnerable Code Example

function updateValues() public {
    // Each access to state reads from storage
    value1 = value1 + 1;
    value2 = value2 + value1;
    value3 = value3 + value2;
}

Description

Inefficient loop patterns that consume unnecessary gas, such as reading array length in each iteration.

Vulnerable Code Example

function processArray(uint[] memory data) public {
    for (uint i = 0; i < data.length; i++) {
        // Process data
    }
}