What are smart contract vulnerabilities?

They are defects in on-chain program logic or configuration that an attacker can use to take funds, mint assets, or break invariants. They are separate from off-chain failures such as stolen keys or compromised RPCs, which caused most of the dollar loss in early 2026.

Which smart contract vulnerability classes have guides here?

Three deep guides are live: reentrancy, flash loan attacks and oracle manipulation, and the OWASP Smart Contract Top 10 (2026). Other classes are listed on this hub without their own pages yet.

Where do the hack figures come from?

From the DeFi hacks list and the sources linked there (rekt.news, protocol incident reports, and firm write-ups). Where sources disagree, that list says so. Figures on this hub match those pages.

Is the OWASP Smart Contract Top 10 the same as this hub?

No. The OWASP page walks each Top 10 item. This hub is the index for "smart contract vulnerabilities" and the breadcrumb parent for the library. Use the OWASP page when you need the ranked list.

Does a scanner find every vulnerability?

No. Pattern tools catch many direct cases. Cross-contract paths, economic logic, and view-function races need review that follows each external call and each trusted number. The scanner and pre-audit pages state their scope.

Smart contract vulnerabilities

Updated October 30, 2026

Smart contract vulnerabilities are flaws in on-chain code that let an attacker drain funds, mint tokens, or break a protocol's rules. Some classes change little year to year: reentrancy, access control, bad arithmetic. Others grow with DeFi design, such as flash-loan price moves and interest math that trusts same-block state.

This page is the index for Guardix's vulnerability guides. It points to the deep pages that already exist, names other common classes that do not have their own guide yet, and links real losses from the DeFi hacks list. For the ranked OWASP list and a short note on each item, use the OWASP Smart Contract Top 10 (2026) page. That page is the answer for "OWASP Smart Contract Top 10". This hub does not repeat that walk-through.

Guides

Guides on this site

Reentrancy

Reentrancy happens when a contract hands control to another contract before it finishes its own work, and that other contract calls back in while state is still stale. The classic path is a withdrawal that sends Ether before it zeros the balance. The guide covers single-function, cross-function, read-only, and token-callback forms, a vulnerable vault, the checks-effects-interactions fix, and a Foundry test.

Real hack: on March 5, 2026, Solv Protocol lost $2.73M when a callback fired before balances were updated and tokens were minted twice (rekt.news).

Flash loan attacks and oracle manipulation

A flash loan attack uses uncollateralized same-transaction capital to move a value a contract trusts, such as a pool price, a share price, or a utilization rate. The flash loan itself is not the bug. The bug is trusting a number an attacker can change inside one transaction. The guide covers spot-price oracles, donation and share-price inflation, governance flash-votes, rate manipulation, a vulnerable lender, and a Chainlink-style fix.

Real hacks: BiFi Lending on October 17, 2026 drained 165,575 USDT after idle interest was multiplied by a rate a flash loan could raise in the same block (about $6.5K not returned; Olympix). Makina Finance lost $4.13M in January 2026 when a flash loan moved pool prices used for share price (rekt.news). Euler Finance lost $197M on March 13, 2023 through a donation path that inflated share accounting (Chainalysis).

OWASP Smart Contract Top 10 (2026)

The OWASP Smart Contract Top 10 ranks the ten smart contract risks OWASP expects to matter most in the coming year. The 2026 ordering comes from 2025 incident data and a practitioner survey: 122 deduplicated smart contract incidents and about $905.4M in losses where a smart contract was involved (OWASP). Our page maps 2026 items to 2025 numbers, gives a short explanation and a real hack for each item where one exists, and links a test you can write against your own contracts.

Classes

Other classes without a deep page yet

These classes show up often in DeFi hacks and on the OWASP list. We have not published a dedicated guide for each one yet. Until then, start from the OWASP Smart Contract Top 10 page and the matching rows on the hacks list.

Access control. A privileged call is open to the wrong caller, or an initializer stays unprotected. The OWASP page covers this class first (SC01). AlpsCon is a 2026 example where an access gate trusted a test account.
Business logic and accounting. The code does what the developer wrote, but the economic rule is wrong: idle interest windows, share accounting, or reward timing. BiFi Lending and UNCX Vesting are recent examples.
Arithmetic. Overflow, underflow, or a wrong scale. Truebit lost $26.2M to an integer overflow in a five-year-old contract (rekt.news).
Signature and authorization. A signature covers less than the call that uses it, or a replayed transaction changes parameters. GiddyDeFi is an example from April 2026.
Input validation. Missing checks on amounts, lengths, or empty values. Dango is an example from April 2026.
Off-chain keys and infrastructure. Compromised signers, RPC nodes, or supply-chain credentials. These are not Solidity bugs. They still dominate loss totals in 2026 (Halborn H1 2026). A code audit does not cover them.

Check

How to check your own contracts

Use these pages before or beside a full audit:

Web3 security checklist for a pass over reentrancy, oracles, flash loans, access control, and related checks.
Smart contract scanner for a first look at Solidity before you deploy.
Smart contract pre-audit for a flat-fee AI run on one repository and commit.

Contact: guardix@dome.net.

FAQ

What are smart contract vulnerabilities?: They are defects in on-chain program logic or configuration that an attacker can use to take funds, mint assets, or break invariants. They are separate from off-chain failures such as stolen keys or compromised RPCs, which caused most of the dollar loss in early 2026.
Which smart contract vulnerability classes have guides here?: Three deep guides are live: reentrancy, flash loan attacks and oracle manipulation, and the OWASP Smart Contract Top 10 (2026). Other classes are listed on this hub without their own pages yet.
Where do the hack figures come from?: From the DeFi hacks list and the sources linked there (rekt.news, protocol incident reports, and firm write-ups). Where sources disagree, that list says so. Figures on this hub match those pages.
Is the OWASP Smart Contract Top 10 the same as this hub?: No. The OWASP page walks each Top 10 item. This hub is the index for "smart contract vulnerabilities" and the breadcrumb parent for the library. Use the OWASP page when you need the ranked list.
Does a scanner find every vulnerability?: No. Pattern tools catch many direct cases. Cross-contract paths, economic logic, and view-function races need review that follows each external call and each trusted number. The scanner and pre-audit pages state their scope.