#02 SC02:2026 Critical ↑ from #3

Business Logic Vulnerabilities

Business logic vulnerabilities describe any situation where a smart contract's intended economic or functional behavior can be subverted even though individual low-level checks are correct. These are design flaws in how system rules, incentives, and state transitions are modeled, distinct from low-level bugs like overflow or reentrancy.

Official OWASP description, from scs.owasp.org (CC BY-NC-SA 4.0).

$189M

2025 losses attributed

20.8%

Of all 2025 SC losses

Why this rank in 2026

Promoted from #3 to #2 and renamed from "Logic Errors". OWASP explicitly expanded the scope to reward and fee logic, eligibility bypasses, path-dependent state machines, and cross-module invariant violations. The Stream Finance $93M loss is cited as the largest single 2025 incident in this class.

Why this category exists separately from SC07 and SC09

Business logic is the most misunderstood category in the OWASP list because it sounds like a catch-all. It is not. OWASP carved it out specifically for design-level flaws that can be exploited even when every individual line passes static analysis. Where SC07 catches a rounding bug and SC09 catches a * that overflows, SC02 catches the case where the math is right but the protocol's economics are wrong.

How the 2025 incidents played out

Stream Finance lost $93M, the largest single business-logic incident of the year (cited directly by OWASP's data-sources page).
Abracadabra lost $12.9M when GMX V2 CauldronV4 collateral accounting allowed a failed deposit, self-liquidation, and borrowing against "ghost" collateral - the collateral-vs-debt invariant was violated even though every individual check passed.
Yearn Finance yETH stableswap lost $9M to a fixed-point solver collapse: an imbalanced add and remove of liquidity minted ~2.35×10^56 tokens against no collateral. Pure design flaw in the curve math.

Why it jumped from #3 to #2

Two reasons. First, the 2025 incident set was disproportionately driven by business-logic bugs at scale (Stream alone is ~10% of the total $905.4M dataset). Second, OWASP expanded the scope of the category to include reward and fee logic, eligibility bypasses, path-dependent state, and cross-module invariant violations - areas that were previously folded into "Logic Errors" but are now explicitly called out.

How AI auditors handle this category

This is the category where AI auditors are weakest. The 2026 benchmarks show frontier LLMs detecting business-logic bugs in roughly 31% of test cases compared to 78% for senior human auditors. The gap exists because business logic requires reasoning about protocol incentives and cross-module state - not pattern matching. Fuzzing tools like Echidna and Medusa close some of the gap on invariant detection, but generating the right invariants still depends on a human's understanding of what the protocol is trying to enforce.

2025 incidents tied to this category

Pulled live from the SCH hack database, ordered by amount lost. Click any incident for the full post-mortem.

View the full SCH hack dashboard →

Vulnerable vs secure code

✗ Vulnerable solidity

// Vulnerable: invariant break - protocol mints rewards before checking deposit succeeded
function deposit(uint256 amount) external {
    rewards[msg.sender] += amount / 10;     // reward minted first
    require(token.transferFrom(msg.sender, address(this), amount), "deposit failed");
    deposits[msg.sender] += amount;
}

✓ Secure solidity

// Secure: checks-effects-interactions + explicit invariant assertion
function deposit(uint256 amount) external nonReentrant {
    require(amount > 0, "zero amount");
    uint256 reward = amount / 10;
    deposits[msg.sender] += amount;         // effect first
    rewards[msg.sender] += reward;
    require(
        token.transferFrom(msg.sender, address(this), amount),
        "deposit failed"
    );
    // Invariant: pool value never exceeds backing
    assert(token.balanceOf(address(this)) >= totalDeposits());
    emit Deposited(msg.sender, amount, reward);
}

AI vs human auditor on this category

Each bar is a detection rate: out of 100 known business logic bugs, how many that auditor type finds. Higher means more reliable. The gap below is the percentage-point difference - the work senior humans still do that AI does not.

AI auditor (frontier LLM)

31%

Human auditor (senior)

78%

% of SC02 bugs caught - higher is better.

Human advantage on SC02

+47 percentage points

Senior auditors catch 47 more business logic bugs per 100 than frontier AI today. That gap is the skill the SCH course teaches.

The largest AI vs human gap of any 2026 category. Business logic bugs require reasoning about protocol incentives, cross-module invariants, and adversarial sequences that AI auditors still cannot generate reliably. This is the strongest argument that AI is not replacing senior auditors in 2026.

Methodology: EVMbench, Cecuro purpose-built agent benchmarks, and senior-auditor self-reported catch rates. SCH editorial, not OWASP-authored.

Prevention checklist

Model protocol economics with adversarial simulations before launch.
Express core invariants as code and enforce them per state transition.
Use formal verification (Certora, Halmos) or property-based fuzzing for accounting paths.
Version + gate new strategies behind caps; raise caps only after on-chain invariant data.
Run on-chain invariant monitoring (Forta, Hypernative) before raising limits.
Ensure governance signers understand the invariants they protect.

Detection tools

Industry-standard tools that detect this category. Tool mappings are SCH editorial - OWASP's per-category pages do not list specific tools.

Echidna

fuzz

property-based fuzzing - primary tool for this class

Medusa

fuzz

parallel coverage-guided fuzzer

Foundry

fuzz

stateful invariant tests

Certora Prover

formal

formal verification of accounting paths

Halmos

formal

symbolic testing on Foundry tests

Deep dive: related SCH attack pages

FAQ

What is OWASP SC02 Business Logic Vulnerabilities?

SC02 covers design-level flaws in a smart contract where the intended economic or functional behavior can be subverted even though every individual code check passes. It is #2 in the OWASP Smart Contract Top 10 2026, covering reward and fee logic, eligibility bypasses, path-dependent state machines, and cross-module invariant violations.

Why did business logic jump from #3 to #2 in OWASP 2026?

Two reasons. First, the 2025 incident set was dominated by business-logic bugs at scale - Stream Finance alone lost $93M, with total business-logic losses reaching $188.7M (about 20.8% of all 2025 smart-contract losses). Second, OWASP expanded the scope of the category to explicitly include reward and fee logic, eligibility bypasses, and cross-module invariants.

What is a business logic vulnerability example in DeFi?

Yearn Finance yETH stableswap (2025, $9M loss) is a textbook example: an imbalanced add and remove of liquidity triggered a fixed-point solver collapse that minted around 2.35x10^56 tokens against no collateral. Abracadabra/GMX V2 CauldronV4 ($12.9M) is another: collateral accounting allowed a failed deposit, self-liquidation, and borrowing against ghost collateral - every individual check passed but the invariant did not hold.

Can Slither or Mythril catch business logic bugs?

Generally no. Slither, Mythril, and Aderyn are weak in this class because business logic depends on protocol-specific invariants that static rules cannot encode. Property-based fuzzers (Echidna, Medusa, Foundry invariants) and formal verification tools (Certora, Halmos) are the primary tools - but they still require a human to write the right invariants first.

Why are AI auditors weak on business logic vulnerabilities?

Business logic requires reasoning about protocol incentives and cross-module invariants, not pattern matching. The 2026 benchmarks show frontier LLMs detecting roughly 31% of business-logic bugs versus 78% for senior human auditors - the largest AI versus human gap of any OWASP 2026 category. This is the single strongest argument that AI is not replacing senior smart contract auditors in 2026.

Sources & methodology

Every claim on this page traces back to a primary, citable source. Open the originals if you want to verify the numbers or read the underlying methodology.

Official

OWASP Foundation

SC02 category page

Canonical description, root causes, and references for Business Logic in the 2026 list.

Project

OWASP Foundation

Smart Contract Top 10 2026

Project landing page covering scope, governance, and the full 10-category ranking.

Methodology

OWASP Foundation

Data sources & ranking method

How OWASP scored each category from 2024-2025 incident data, audit reports, and contributor surveys.

Dataset

CredShields

Web3HackHub incident database

Continuously updated public dataset of on-chain exploits used to cross-check loss figures.

Quoted OWASP descriptions are used under CC BY-NC-SA 4.0. SCH editorial content (analysis, code, prevention prose, FAQ, AI-vs-human rates) is © Smart Contract Hacking.

Continue through OWASP 2026

← Back to the OWASP 2026 hub

Master the techniques that make this category exploitable

The SCH Smart Contract Hacking Course teaches the exploit primitives, audit techniques, and tool workflows for business logic vulnerabilities and every other OWASP 2026 category.

Explore the course Estimate an audit