246 Findings From our Smart Contract Audits: An Executive Summary
Summary: Trail of Bits analyzed 246 smart-contract findings from 23 paid audits, five of them private, and found data validation flaws were the most common at 36% of findings, followed by access control at 10%. Reentrancy, widely discussed after the DAO attack, accounted for only 4 of the 246 findings and produced no high-severity, low-difficulty issues, while access control, authentication, timing, and numerics each had high-low rates above 20%.
Key Takeaway: The firm estimates that even combining static and dynamic analysis in the best case would catch only 21 of the 27 high-severity, low-difficulty findings, and that 35% of high-severity findings are unlikely to be detected automatically at all - so a clean tool run is not evidence that a contract is safe.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026