The functionality of DeFi projects depends on a significant amount of underlying infrastructure. This infrastructure can contain various vulnerabilities that place the security and usability of the protocols at rest.

Some key classes of DeFi infrastructure vulnerabilities include:

Blockchain and Network-Level Vulnerabilities: These are security risks associated with the blockchain and the infrastructure that it depends upon. Examples include consensus vulnerabilities and the security of cross-chain bridges.
Protocol-Level Vulnerabilities: Common elements of DeFi protocols can contain security risks exploitable by an attacker. For example, a protocol may be vulnerable to price oracle manipulation, frontrunning, or manipulation of liquidity pools.
Smart Contract Vulnerabilities: DeFi protocols are implemented as smart contracts, which can contain design or implementation errors. Reentrancy, integer overflows and underflows, and access control issues are common examples of smart contract issues affecting DeFi projects.

Blockchain and Network-Level Security Risks

DeFi protocols are built on top of blockchains or other distributed ledger technology (DLT). DeFi protocols rely on this underlying infrastructure to provide certain guarantees with regard to functionality and security. For example, protocols may assume that transactions will be processed within a reasonable amount of time and that the distributed ledger is immutable and protected against double-spend attacks. DeFi protocols may also rely on other infrastructure, such as secure cross-chain bridges, as well.

While these features may be valuable or vital to the security and performance of DeFi protocols, they may not always be guaranteed. Some examples of blockchain and network-level infrastructure vulnerabilities in DeFi include:

Protocol-Level Vulnerabilities

DeFi protocols implement various features, and many of them have certain requirements, such as accurate pricing information.

The ways that these projects fulfill these needs can open them up to potential attacks, such as:

Smart Contract Vulnerabilities

DeFi projects are implemented as smart contracts that run on-chain. Logical or implementation errors in these smart contracts can open up the project to attack.

Some common vulnerabilities impacting DeFi smart contracts include:

Reentrancy: Reentrancy attacks exploit scenarios where a smart contract transfers execution to another smart contract without performing a complete state update. This could allow the contract to reenter the original contract and exploit the invalid stored state information.
Integer Overflows and Underflows: Variables in smart contracts have fixed sizes that can store a particular range of values. Calculations using values that stray outside of these bounds can render a smart contract exploitable if safe mathematical functions aren’t used. For example, a protocol expecting to receive only positive values from a user may break if it receives a negative one.
Access Control: Anyone can interact with a smart contract on the blockchain; however, DeFi protocols commonly perform privileged actions (like minting tokens). To prevent misuse of these functions, they should include access controls. However, any vulnerability in these access controls could open up the protocol to attack.

For more information about the top smart contract vulnerabilities impacting DeFi projects, check out Halborn’s Top 100 DeFi hacks report.

Managing the Security Risks of DeFi Infrastructure

DeFi projects are complex protocols with many potential points of failure. They assume that the blockchain infrastructure is functional and secure and that the DeFi protocols themselves and the smart contracts that implement them are free from errors.

While DeFi infrastructure risks are outside of a protocol’s direct control, a project can manage its exposure to these and their potential repercussions. Others, like smart contract vulnerabilities, are the direct responsibility of the project to address.

Comprehensive smart contract audits are essential to ensure the functionality and security of DeFi protocols. For help with securing your DeFi project, reach out to Halborn.