Our AI contract audit service finds business-logic, economic, and cross-contract flaws that static scanners miss. Here are real vulnerabilities it detected in standard vulnerable contract samples — each with a concrete exploit analysis.
The withdrawFunds function sends ETH before updating the balance, allowing an attacker to re-enter and drain all funds — the classic checks-effects-interactions violation.
The signed message in the transfer proxy does not include the contract address or chain ID. A signature obtained on one contract can be replayed on another contract with the same method, draining funds — the pattern behind multiple bridge hacks.
The Proxy contract uses delegatecall without access control, and the implementation address in slot 0 collides with the Logic contract's storage — enabling an attacker to overwrite critical state and seize control.
approveAndCallcode sets allowance for msg.sender then executes arbitrary code from _spender — a known pattern for stealing user allowances.