OWASP·SC03·high

Logic errors

The code does exactly what it says, and what it says is wrong.

What it is

Accounting that credits before it debits, a reward formula that pays more than it collects, a fee that can be set to 100%, an off-by-one in a supply cap, a pause with no unpause. No pattern matcher finds these, because nothing about the syntax is unusual.

Why it matters

Ranges from slow value leakage to immediate insolvency. Because the code is syntactically fine, these usually survive automated review and are found either by a human auditor or by an attacker.

How to fix it

  • Write down the invariants that must always hold — total supply, sum of balances, collateral ratios — and test them with fuzzing or formal methods.
  • Have someone who did not write the code restate what it does from the code alone, and compare that to the specification.
  • Model the economics separately from the implementation.

How it is detected

Every audit on EVM Smart Audit checks for SC03 and reports it as passed or flagged in the standards coverage grid — so the report tells you it was checked even when nothing was found. See the detector suite for what else runs alongside it, or the full database for the other 21 checks.

Related weaknesses

Check your contract for logic errors

The engine runs this check and 21 others on every audit, and shows what passed as well as what failed.

Start your auditSee pricing