Web3 & EVM Security

OWASP Smart Contract Security Top 10 (2025 Evolution)

Discover the OWASP Smart Contract Top 10 2025 and learn about blockchain security vulnerabilities.

OWASP Smart Contract Top 10 (2025 Ranking Table)

Based on incidents documented in SolidityScan's Web3HackHub and Immunefi's Crypto Losses Report, these vulnerabilities continue to pose significant risks to blockchain applications. Organizations must prioritize security measures and regular audits to protect against these emerging threats.

Rank	Vulnerability	Description	Impact
1	Access Control Vulnerabilities	Weaknesses in access control mechanisms allowing unauthorized access. Led to $953.2M in losses (2024).	Critical
2	Price Oracle Manipulation New	Exploitation of price feed mechanisms to manipulate asset valuations and trigger malicious trades.	Critical
3	Logic Errors	Business logic flaws leading to improper token minting, flawed lending protocols, or incorrect reward distributions ($63M in losses).	High
4	Lack of Input Validation New	Insufficient validation of user input leading to injection attacks and data corruption.	High
5	Reentrancy Attacks	Vulnerabilities allowing attackers to repeatedly call functions before previous executions complete. Notable: The DAO hack ($70M).	Critical
6	Unchecked External Calls	Insecure handling of external contract calls and API interactions leading to inconsistent states.	High
7	Flash Loan Attacks New	Exploitation of flash loan mechanisms to manipulate markets or drain liquidity pools.	Critical
8	Integer Overflow and Underflow	Arithmetic operation errors leading to balance manipulation or restriction bypasses.	High
9	Insecure Randomness	Predictable randomness compromising lotteries, token distributions, and game logic.	High
10	Denial of Service (DoS) Attacks	Resource exhaustion attacks targeting gas limits or computational resources.	High

SC05:2025

Reentrancy & CEI Defense Pattern

// VULNERABLE: State updated AFTER external call
function withdraw(uint256 amount) public {
    require(balances[msg.sender] >= amount);
    (bool success, ) = msg.sender.call{value: amount}(""); // Reentrancy vulnerability here!
    balances[msg.sender] -= amount;
}

// SECURE: Checks-Effects-Interactions (CEI) Pattern + ReentrancyGuard
function withdraw(uint256 amount) public nonReentrant {
    require(balances[msg.sender] >= amount);
    balances[msg.sender] -= amount; // Update state FIRST
    (bool success, ) = msg.sender.call{value: amount}(""); // External call LAST
    require(success, "Transfer failed");
}
      