What does a smart contract audit for DeFi cover that a generic Solidity scan does not?

Generic scanners stop at reentrancy, access control, and missing checks. A DeFi audit has to follow value: which oracle a liquidation trusts, how AMM reserves set a spot price, how a vault turns assets into shares, and whether a flash loan can move those numbers inside one transaction. Guardix extracts the invariants those paths claim to hold, then tries to break them.

How do you check oracle manipulation?

Every price read is traced to its source. Spot AMM prices feeding a mint or liquidation, single-source feeds, missing staleness or heartbeat checks, and TWAP windows short enough to twist in one block are critical candidates. Coverage is graded against the freshness and manipulation-resistance invariant extracted for that feed - not against a generic 'use Chainlink' rule.

What AMM and LP issues are in scope?

Rounding that favors the caller, a broken k-invariant, fee-on-transfer or rebasing tokens corrupting reserve accounting, first-depositor share inflation, and donation attacks on balanceOf-based reserves. Guardix checks constant-product and share-issuance invariants, including the empty-pool and single-wei deposit cases.

How are ERC-4626 vault share-price bugs audited?

convertToShares / convertToAssets rounding the wrong direction, first-deposit inflation, a share price movable by a direct token transfer, and withdrawals that read stale totalAssets. The shares-to-assets monotonicity invariant - no holder gains free value from someone else's deposit - is extracted before findings are raised. The classic empty-vault donation drain is a fork-exploit candidate.

What about liquidation and bad debt?

Liquidations priced off a manipulable oracle, health-factor math rounding the wrong way, self-liquidation, a bonus that leaves the protocol insolvent, and interest accrual that can be front-run. Findings are graded against the collateralization invariant - a position cannot be drawn below the LTV threshold without reverting - and against the bad-debt invariant.

Do flash loans change how findings are graded?

Yes. A flash loan is not a bug class on its own. Every finding is reasoned about under the attacker-has-unbounded-single-transaction-capital assumption. When a critical is proven, the fork proof of concept actually takes a flash loan and drives the drain end to end.

Will this replace a manual DeFi audit?

No. Run Guardix to clear mechanical and known-class DeFi attack surface - oracle, AMM, vault, liquidation, flash-loan amplifiers - then spend the human budget on novel economic design, multi-protocol composability, governance attacks, and MEV strategy. Those are still where a human wins.

How much does a Guardix DeFi audit cost?

A full audit is $200 per repository commit, the same price as any other Guardix code audit. Re-runs are the same flat $200 and are diffed against the last scan. There is no DeFi surcharge and no subscription.

DeFi security audits

The bugs that drain DeFi aren't in the syntax. They're in the math.

A smart contract audit for DeFi has to follow the money: the oracle a liquidation trusts, the AMM math behind a spot price, the vault share formula a depositor is minted against, and the flash loan that makes all of that happen in one transaction. Guardix maps your protocol's invariants first, then hunts those failure modes against them - and proves the critical ones with a working exploit on a mainnet fork.

Start an audit See how verdicts are earned Smart contract audit →

Built for Solidity teams shipping on EVM

Ethereum

Arbitrum

Optimism

Base

Polygon

01DeFi, not just Solidity

The drain is usually a chain, not a missing modifier.

Reentrancy and access control still matter. The losses that empty DeFi protocols usually start somewhere else: a price the contract trusts, a share formula, a liquidation bonus, then a flash loan that makes those fire in one transaction.

A generic Solidity audit asks whether a function can be called twice, or whether only the owner can pause. A smart contract audit for DeFi has to ask what number the protocol treats as truth, who can move that number, and what happens to vault shares and collateral when they do.

Those questions compose. An oracle read is often harmless until a liquidation engine uses it. A liquidation engine is often solvent until a flash loan supplies the inventory. An ERC-4626 vault can look correct in isolation and still mint zero shares to the next depositor after a donation. Guardix extracts the invariants those systems claim to hold - feed freshness, constant-product, shares-to-assets monotonicity, collateralization - then tries to violate them in that order.

1

Oracle

A spot AMM price, a single-source feed, or a short TWAP becomes the number a mint, borrow, or liquidation trusts.
2

AMM / LP

Reserves, fees, and share math decide whether that price - or an LP position - can be twisted inside one block.
3

Vault

convertToShares / totalAssets reads that number, or a raw balanceOf, and mints the wrong shares to the attacker.
4

Liquidation

Health-factor math fires on the manipulated price; the bonus or bad-debt path pays the attacker instead of making the protocol whole.
5

Flash loan

Unbounded same-transaction capital turns a small skew into a drain, then repays inside the same block. Not a bug class - an amplifier.

02Attack surface

Seven ways DeFi protocols get drained.

Generic Solidity scanners stop at reentrancy and missing checks. These are the failure modes that move money — and the exact thing Guardix grounds each one in.

01 Oracle & price manipulation: Mechanism Spot price read from an AMM pool, a single-source feed, a missing staleness/heartbeat check, or a TWAP window short enough to flash-twist within one block.; Coverage Guardix flags every price read, traces it to its source, and checks it against the freshness and manipulation-resistance invariant it extracted for that feed. A spot price feeding a mint or a liquidation is a critical candidate.
02 AMM / LP & swap math: Mechanism Rounding that favors the caller, a broken k-invariant, fee-on-transfer or rebasing tokens corrupting reserve accounting, first-depositor share inflation, or a donation attack on a balanceOf-based reserve.; Coverage It checks the constant-product and share-issuance invariants, models the empty-pool and single-wei deposit cases, and watches for reserves read from raw token.balanceOf(this).
03 Vault / ERC-4626 share price: Mechanism convertToShares / convertToAssets rounding the wrong direction, an inflation or donation attack on the first deposit, a share price movable by a direct transfer, or a withdrawal reading stale totalAssets.; Coverage Guardix extracts the shares-to-assets monotonicity invariant — no holder gains free value — and tries to violate it. The classic first-depositor inflation drain is a fork-exploit candidate.
04 Lending, liquidation & bad debt: Mechanism Liquidation priced off a manipulable oracle, health-factor math rounding the wrong way, self-liquidation, a liquidation incentive that leaves the protocol insolvent, or interest accrual that can be front-run.; Coverage Findings are graded against the collateralization invariant — a position can never be drawn below the LTV threshold without reverting — and the bad-debt invariant, then liquidation entry points are checked against both.
05 Flash-loan-enabled drains: Mechanism Not a bug class on its own — an amplifier. Single-transaction access to unbounded capital turns a small oracle skew, a governance-quorum gap, or a share-price wobble into a full drain.; Coverage Every finding is reasoned about under the attacker-has-unlimited-single-tx-capital assumption — and the fork proof of concept actually takes a flash loan to drive the drain end to end.
06 Cross-chain & bridge trust: Mechanism Message-verification gaps, replayable proofs, trusting an L2-to-L1 message before finality, a mint without a matching burn, or unstated relayer assumptions.; Coverage Guardix maps the trust boundary — who can produce a valid message — checks the mint/release path against the locked-equals-minted invariant, and flags any release that doesn't verify the source-chain proof.
07 Accounting & invariant drift: Mechanism An internal ledger diverging from real token balances, fee accounting that double-counts, reward math that can be claimed twice, or totalSupply drifting from the sum of balances after an edge path.; Coverage This is what the invariant-extraction pass exists for: every accounting invariant becomes a finding-grading rule, and any drift between accounting state and actual balances is graded against it.

An eighth surface — MEV and transaction ordering — sits partly in scope: a missing deadline or an unsanitized slippage bound is mechanical, but sandwich economics and extraction strategy are where a human still wins. See the honest line below.

03A finding, end to end

A share-price finding, traced from the line to the drained vault.

Not a textbook reentrancy. A real ERC-4626 economic bug - the code, the invariant it violates, and the verdict Guardix had to earn.

critical · price manipulation · VAU-3

First-depositor inflation lets an attacker steal later deposits.

The first deposit sets the share rate 1:1, then totalAssets() reads balanceOf. An attacker mints one share, donates assets directly to the vault to inflate the rate, and every subsequent depositor rounds down to zero shares — their funds become the attacker's.

ERC4626Vault.sol lines 88–93

                  
                      
                        88
                      
                      
                          
                        function deposit(uint256 assets) external returns (uint256 shares) {
                      
                    

                      
                        89
                      
                      
                            
                        shares = totalSupply == 0
                      
                    

                      
                        90
                      
                      
                              
                        ? assets // first depositor sets the rate 1:1
                      
                    

                      
                        91
                      
                      
                              
                        : assets * totalSupply / totalAssets();  // totalAssets reads balanceOf
                      
                    

                      
                        92
                      
                      
                            
                        _mint(msg.sender, shares);
                      
                    

                      
                        93
                      
                      
                          
                        }

Graded against your invariant

INV-006 state

Shares and assets stay monotonic — no depositor can gain or lose value from another deposit. Share price must not be movable by a direct token transfer.

Extracted from the vault during the architecture pass, before any finding was raised. The deposit path on line 89 can violate it whenever the vault is empty.

The verdict, earned

Kept — proven on a fork

A flash loan minted one share, donated to inflate the rate, and stole the next depositor's 40 ETH on a mainnet fork. The exploit script ships with the finding.

Had a virtual-shares offset or a dead-shares mint guarded line 89, Guardix would cite that line and drop it — never silently.

04By protocol type

Find your system. See what we check.

The named checks Guardix runs for each protocol family - not a taxonomy of categories you already know.

DEX / AMM: k-invariant preservation
fee-on-transfer & rebasing tokens
first-deposit / donation inflation
slippage & deadline on swaps
Lending & borrowing: oracle source for liquidation
health-factor rounding direction
bad-debt socialization path
interest-accrual front-running
Vaults & yield (ERC-4626): share ↔ asset rounding direction
first-depositor inflation
strategy-loss accounting
withdrawal reading stale totalAssets
Perps & derivatives: funding-rate manipulation
mark vs index price source
liquidation-engine solvency
open-interest / position caps
Bridges & cross-chain: message-verification completeness
replay protection
locked == minted invariant
finality assumptions
Stablecoins & RWA: peg defense under depeg
reserve / collateral accounting
mint / redeem authority
pause / blocklist privilege scope

05The honest line

What we won't pretend to catch.

Manual auditors genuinely win on the bugs that live in your protocol's economic design, not its code. On a DeFi page, where economic attacks dominate, pretending otherwise would be the easiest way to lose your trust.

So run Guardix continuously to clear the mechanical and known-class DeFi attack surface for $200 a commit — then spend the human budget where it actually pays off.

Read the full comparison →

Where a human still wins

Novel, bespoke economic exploits with no precedent in code or history
Multi-protocol composability and game-theoretic incentive failures
Governance-attack economics and quorum / timelock design
MEV strategy design — ordering and extraction beyond a missing deadline
Mechanism-design flaws that are correct in code but wrong by intent

06Every commit

Every new strategy is new attack surface.

DeFi protocols ship fixes, adapters, and integrations constantly. A one-shot human audit is stale the moment you add a vault adapter or a new collateral type. Guardix re-runs on every commit and diffs against the last scan - same $200.

e7b2f4a −2 critical vs previous scan Read how it works →

07FAQ

What teams actually ask before a DeFi audit.

Oracle, AMM, vault, liquidation, and flash-loan coverage - plus what a human still has to do, and what $200 buys.

What does a smart contract audit for DeFi cover that a generic Solidity scan does not?: Generic scanners stop at reentrancy, access control, and missing checks. A DeFi audit has to follow value: which oracle a liquidation trusts, how AMM reserves set a spot price, how a vault turns assets into shares, and whether a flash loan can move those numbers inside one transaction. Guardix extracts the invariants those paths claim to hold, then tries to break them.
How do you check oracle manipulation?: Every price read is traced to its source. Spot AMM prices feeding a mint or liquidation, single-source feeds, missing staleness or heartbeat checks, and TWAP windows short enough to twist in one block are critical candidates. Coverage is graded against the freshness and manipulation-resistance invariant extracted for that feed - not against a generic 'use Chainlink' rule.
What AMM and LP issues are in scope?: Rounding that favors the caller, a broken k-invariant, fee-on-transfer or rebasing tokens corrupting reserve accounting, first-depositor share inflation, and donation attacks on balanceOf-based reserves. Guardix checks constant-product and share-issuance invariants, including the empty-pool and single-wei deposit cases.
How are ERC-4626 vault share-price bugs audited?: convertToShares / convertToAssets rounding the wrong direction, first-deposit inflation, a share price movable by a direct token transfer, and withdrawals that read stale totalAssets. The shares-to-assets monotonicity invariant - no holder gains free value from someone else's deposit - is extracted before findings are raised. The classic empty-vault donation drain is a fork-exploit candidate.
What about liquidation and bad debt?: Liquidations priced off a manipulable oracle, health-factor math rounding the wrong way, self-liquidation, a bonus that leaves the protocol insolvent, and interest accrual that can be front-run. Findings are graded against the collateralization invariant - a position cannot be drawn below the LTV threshold without reverting - and against the bad-debt invariant.
Do flash loans change how findings are graded?: Yes. A flash loan is not a bug class on its own. Every finding is reasoned about under the attacker-has-unbounded-single-transaction-capital assumption. When a critical is proven, the fork proof of concept actually takes a flash loan and drives the drain end to end.
Will this replace a manual DeFi audit?: No. Run Guardix to clear mechanical and known-class DeFi attack surface - oracle, AMM, vault, liquidation, flash-loan amplifiers - then spend the human budget on novel economic design, multi-protocol composability, governance attacks, and MEV strategy. Those are still where a human wins.
How much does a Guardix DeFi audit cost?: A full audit is $200 per repository commit, the same price as any other Guardix code audit. Re-runs are the same flat $200 and are diffed against the last scan. There is no DeFi surcharge and no subscription.

Audit your protocol before the exploit does.

Connect your repo and get a DeFi-aware report — oracle, AMM, vault, and liquidation findings graded against your invariants, with the criticals proven on a fork.

Start an audit Compare with manual audits