🛡️ Case Study: Reentrancy Critical Found Before Deploy

This is a real audit run through minia2a's contract-audit service. The contract below has a classic reentrancy vulnerability and an unvalidated arbitrary call — both caught before deploy. It's the kind of bug that has drained millions from DeFi protocols.

The contract

A simple vault with deposit/withdraw:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
contract ReentrancyVictim {
    mapping(address => uint) public balances;
    function deposit() external payable { balances[msg.sender] += msg.value; }
    function withdraw() external {
        uint amt = balances[msg.sender];
        (bool ok, ) = msg.sender.call{value: amt}("");  // external call FIRST
        require(ok, "transfer failed");
        balances[msg.sender] = 0;                        // state updated AFTER
    }
    function ownerOnly() external { msg.sender.call(""); }  // unvalidated call
}

What the AI deep audit found

CRITICAL

Reentrancy — checks-effects-interactions violation
The withdraw function sends ETH via msg.sender.call{value: amt} before updating balances[msg.sender]. An attacker's fallback function can re-enter withdraw and drain the balance repeatedly, because the balance is only zeroed after the call returns.

Fix: update state before the external call (or use a reentrancy guard / checks-effects-interactions ordering).

HIGH

Unvalidated arbitrary call + missing access control
The ownerOnly function is callable by anyone (no modifier) and performs an arbitrary msg.sender.call("") with no validation — enabling a malicious contract to execute arbitrary logic in the calling context.

Fix: add an access-control modifier and validate/remove the arbitrary call.

How the detection worked

minia2a runs two layers:

$2 static pre-check — deterministic pattern detection. Caught the reentrancy (CEI violation).
$20 AI deep audit — LLM review of business logic. Caught both the reentrancy and the unvalidated call the scanner missed, with correct severity ranking.

The AI audit sampled the contract 3× for stability and honestly reported the highest severity — critical.

Why this matters

Reentrancy attacks have drained hundreds of millions of dollars from DeFi (The DAO $60M, Cream Finance $130M, and many more). A $2 pre-deploy check that catches this pattern before your launch is cheap insurance.

Audit your contract →
Static $2 · AI deep $20 · Audit from $2 for Base launches