Smart contract attack vectors

The goal of this repository is to compile all possible smart contract vulnerabilities and resources for learning about them.

Feel free to submit a pull request, with anything from small fixes to docs or tools you'd like to add.

List of Security Vulnerabilities

• Access Control
  • Authentication With tx.origin
  • Default Visibility
  • Signature Verification
  • Unprotected Ether Withdrawal
  • Unprotected SELFDESTRUCT Instruction
  • Missed Modifier
  • Incorrect Modifier Names
  • Overpowered Roles
• Account Existence Check for low level calls
• Arbitrary Jumps with Function Variables
• Assert Violation
• Bypass Contract Size Check
• Code With No Effects
• Complex Modifiers
• DOS
  • Unexpected Revert
  • Block Gas Limit
  • External Calls without Gas Stipends
• Dirty Higher Order Bits
• Entropy Illusion / Insecure Randomness
• Experimental Language Features
• External Contract Referencing
• Flash Loan Attacks
• Floating Point Arithmetic
• Frontend (Off Chain) Attacks_Attacks.md>)
  • Short Address Attack_Attacks.md/>)
• Force Feeding
• Function Selector Abuse
• Griefing
• Hiding Malicious Code
• Historic Attacks
  • Constructor Names
  • Call Depth Attack
  • Solidity Abi Encoder v2 Bug
• Improper Array Deletion
• Incorrect Interface
• Insufficient Gas Attacks
• Integer Arithmetic
• Loop through long arrays
• Message call with hardcoded gas amount
• Miner Attacks
  • Transaction Ordering / Frontrunning
  • Timestamp Manipulation
• Offline Owner
• Oracle Manipulation
• Outdated Compiler
• Payable Multicall
• Precision Loss in Calculations
• Privacy Illusion