Smart Contract Security Glossary

Reentrancy

Reentrancy is a smart contract vulnerability where external code calls back into a contract before the first call finishes, often before balances, ownership, or other state has been updated.

Read-Only Reentrancy

Read-only reentrancy happens when a view function returns stale or inconsistent state during an unfinished state transition, and another contract relies on that value.

Access Control Vulnerability

An access control vulnerability lets an unauthorized caller perform privileged actions such as moving funds, changing roles, upgrading contracts, or changing protocol settings.

Signature Replay

Signature replay happens when a valid signature can be reused more than once or reused in a different context than the signer intended.

Unchecked Return Value

An unchecked return value bug happens when code ignores whether a low-level call or token operation succeeded.

Weak Randomness

Weak randomness is predictable or manipulable randomness used for security-critical smart contract decisions.

Gas Griefing

Gas griefing is an attack or failure mode where a caller, receiver, or loop structure causes execution to fail by controlling gas usage.

NFT Smart Contract Vulnerabilities

NFT smart contract vulnerabilities are bugs that affect NFT ownership, minting, transfers, approvals, metadata, royalties, or marketplace integrations.

Governance Attack

A governance attack is an exploit where an attacker gains or abuses proposal, voting, execution, or admin power in a governance system.

Flash Loan Governance Attack

A flash loan governance attack uses borrowed voting power to influence or execute governance actions before the loan is repaid.

Bridge Exploit

A bridge exploit is an attack against bridge custody, message validation, validator signatures, minting logic, or replay protection.

Replay Attack

A replay attack reuses a valid transaction, signature, message, or proof in a context where it should only be valid once.

Reinitialization

Reinitialization is calling an initializer or versioned reinitializer after deployment or upgrade to set new contract state.

Signature Malleability

Signature malleability is the ability to transform a valid signature into another valid signature for the same message.

Upgrade Authorization

Upgrade authorization is the access-control logic that decides who can change a proxy implementation.

ERC4626 Inflation Attack

An ERC4626 inflation attack manipulates an empty or low-supply vault's asset-to-share rate so a victim receives too few shares.

Donation Attack

A donation attack manipulates protocol accounting by transferring tokens directly to a contract without using the intended deposit path.

Share Price Manipulation

Share price manipulation changes the calculated value of vault, pool, or receipt-token shares to exploit deposits, withdrawals, collateral, or rewards.

Exchange Rate Manipulation

Exchange rate manipulation changes a conversion rate between assets, shares, wrappers, or collateral tokens to exploit protocol accounting.

Stale Oracle Price

A stale oracle price is an old oracle value that is still returned but no longer reflects current market or protocol conditions.

Oracle Decimal Mismatch

Oracle decimal mismatch happens when code scales an oracle answer with the wrong decimal precision.

Denial of Service

Denial of service is a bug or attack that makes a contract function or protocol path unusable.

Unbounded Loop

An unbounded loop is a loop whose iteration count can grow with user input or contract state instead of a safe fixed limit.

Dust Attack

A dust attack introduces tiny unwanted balances or positions to trigger accounting edge cases.