The smart contract vulnerabilities that dominated headlines in 2021 — reentrancy, integer overflow, unchecked external calls — are largely solved problems. Modern DeFi exploits are more sophisticated: they live in the seams between protocols, in oracle assumptions, and in governance mechanisms that were never stress-tested under adversarial conditions.
The Composability Risk Nobody Models
Every DeFi integration adds a new trust surface. When your protocol calls an external AMM for pricing, borrows liquidity from a lending pool, or relies on a governance vote to adjust parameters, you inherit the risk profile of each. Composability is DeFi’s superpower, but most audit frameworks treat each contract in isolation. A flash loan exploit does not attack your contract — it attacks the system your contract assumes is stable.
Oracle Manipulation: Still the Most Exploited Vector
On-chain price oracles remain the single most common exploit vector in production DeFi. TWAP oracles reduce but do not eliminate manipulation risk — a well-capitalised attacker with enough block time can still move a TWAP window. Chainlink feeds shift the risk to oracle node centralisation. The failure is not in the choice of oracle. It is in not modelling what happens to your protocol’s invariants when the price feed moves 40% in one block.
Governance as an Attack Surface
Governance attacks are underweighted in most security reviews. A protocol that allows token-weighted on-chain voting to upgrade contracts or drain the treasury is a protocol where purchasing a majority stake is economically equivalent to owning the smart contracts. This is not a theoretical risk — it has been executed at eight-figure scale. The fix is not always a longer timelock. It is designing governance boundaries so that no single vote can move critical parameters without multi-sig or time-delayed review.
What a Real Audit Covers
- Contract logic review — state machine correctness, access control, arithmetic boundaries
- Composability analysis — external call surfaces, re-entrancy paths, and cross-protocol assumptions
- Oracle dependency mapping — feed sources, fallback behaviour, and manipulation thresholds
- Governance risk modelling — voting power distribution, upgrade paths, and parameter change impact
- Operational security — key management, incident response playbook, and monitoring setup
Security is a system property, not a contract property. The protocols that survive adversarial conditions are those designed with failure modes in mind from the first architecture decision — not ones that added a bug bounty after launch.