This is a real audit run through minia2a's contract-audit service. The contract below has a classic reentrancy vulnerability and an unvalidated arbitrary call — both caught before deploy. It's the kind of bug that has drained millions from DeFi protocols.
A simple vault with deposit/withdraw:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
contract ReentrancyVictim {
mapping(address => uint) public balances;
function deposit() external payable { balances[msg.sender] += msg.value; }
function withdraw() external {
uint amt = balances[msg.sender];
(bool ok, ) = msg.sender.call{value: amt}(""); // external call FIRST
require(ok, "transfer failed");
balances[msg.sender] = 0; // state updated AFTER
}
function ownerOnly() external { msg.sender.call(""); } // unvalidated call
}Reentrancy — checks-effects-interactions violation
The withdraw function sends ETH via msg.sender.call{value: amt} before updating balances[msg.sender]. An attacker's fallback function can re-enter withdraw and drain the balance repeatedly, because the balance is only zeroed after the call returns.
Fix: update state before the external call (or use a reentrancy guard / checks-effects-interactions ordering).
Unvalidated arbitrary call + missing access control
The ownerOnly function is callable by anyone (no modifier) and performs an arbitrary msg.sender.call("") with no validation — enabling a malicious contract to execute arbitrary logic in the calling context.
Fix: add an access-control modifier and validate/remove the arbitrary call.
minia2a runs two layers:
The AI audit sampled the contract 3× for stability and honestly reported the highest severity — critical.
Reentrancy attacks have drained hundreds of millions of dollars from DeFi (The DAO $60M, Cream Finance $130M, and many more). A $2 pre-deploy check that catches this pattern before your launch is cheap insurance.