Vulnerability database

Every Bug Class, With The Code

Cause, impact, vulnerable pattern and fix for each check.

12 SWC10 OWASP8 critical6 high5 medium3 low

SWC Registry

The classic catalogue of Solidity and EVM weaknesses.

SWC-107ReentrancyAn external call hands control to the callee before your own state is finished updating.criticalSWC-105Unprotected access / privileged functionsA function that moves money or changes ownership has no modifier restricting who can call it.criticalSWC-106Unprotected selfdestructselfdestruct is reachable without an access-control check.criticalSWC-112Delegatecall to an untrusted calleedelegatecall runs someone else’s code against your storage and your balance.criticalSWC-115Authorization via tx.originAuth compares against tx.origin, which any intermediary contract can carry along.highSWC-101Integer overflow and underflowArithmetic wraps silently instead of reverting.highSWC-120Weak randomnessRandomness derived from block or transaction values the proposer controls.highSWC-104Unchecked call return valueThe boolean returned by a low-level call is discarded, so failures pass silently.mediumSWC-128Denial of service by gas or unbounded operationsA loop over data that users can grow eventually exceeds the block gas limit.mediumSWC-116Block values as a time proxyLogic depends on block.timestamp at a resolution block producers can influence.lowSWC-103Floating pragmaA caret pragma lets the deployed bytecode come from a compiler you never tested.lowSWC-119Variable shadowingA local or parameter hides a state variable, so writes go to the wrong place.low

OWASP Smart Contract Top 10

Ordered by what actually causes losses.

SC01Access control vulnerabilitiesMissing, wrong, or over-broad permissions on state-changing functions.criticalSC02Price oracle manipulationA price the contract trusts can be moved within a single transaction.criticalSC05Reentrancy attacksThe OWASP framing of the same failure as SWC-107, including the cross-contract variants.criticalSC07Flash loan attacksUncollateralised capital within one transaction breaks any assumption that size implies commitment.criticalSC03Logic errorsThe code does exactly what it says, and what it says is wrong.highSC08Integer overflow and underflowThe OWASP framing of SWC-101, with emphasis on unchecked blocks and unsafe casts.highSC09Insecure randomnessThe OWASP framing of SWC-120 — on-chain randomness is not private.highSC04Lack of input validationParameters are used without checking that they are within sane bounds.mediumSC06Unchecked external callsReturn values ignored, or external contracts trusted to behave.mediumSC10Denial of serviceThe contract can be put into a state where legitimate operations no longer succeed.medium

How to use this

Read it as the checklist an audit runs, rather than as an encyclopedia. If you are shipping a contract, the fastest path is to work down the critical and high entries first — they account for the overwhelming majority of real losses — and to treat the low-severity entries as hygiene you fix once and never think about again.

Everything here is checked automatically on every audit, and the report shows which items passed as well as which fired. The audit checklist covers the same ground as a working procedure rather than a reference.

Check your contract against all of these

The engine runs every entry above and reports what passed as well as what failed. Testnet scans are free.

Sample audit report: security score 82/100, findings by severityView sample report (PDF) ›
Sign in
Start audit