# Solidity Vulnerability Checklist

This document organizes common Solidity vulnerability types and detection methods for audit verification.

## 1. Reentrancy Attacks

### Detection Points
- [ ] External calls before state updates
- [ ] View functions called externally before state changes
- [ ] Callback functions without reentrancy guards

### Code Patterns
```solidity
// DANGEROUS: External call before state update
function withdraw() external {
    msg.sender.call{value: balance}("");
    balances[msg.sender] = 0;
}

// SAFE: CEI Pattern
function withdraw() external {
    uint256 amount = balances[msg.sender];
    balances[msg.sender] = 0;
    msg.sender.call{value: amount}("");
}
```

---

## 2. Access Control Issues

### Detection Points
- [ ] Sensitive functions without modifiers
- [ ] Initialization functions unprotected
- [ ] Role management vulnerabilities

---

## 3. Integer Overflow/Underflow

### Detection Points
- [ ] unchecked blocks
- [ ] Solidity < 0.8.0
- [ ] Type casting to smaller types

---

## 4. Signature Verification Issues

### Detection Points
- [ ] Signature replay across chains
- [ ] Signature malleability
- [ ] Missing deadline validation

---

## 5. Oracle Manipulation

### Detection Points
- [ ] Using current AMM reserves as price
- [ ] Single price source
- [ ] No TWAP protection

---

## 6. Flash Loan Vulnerabilities

### Detection Points
- [ ] State checks only balance, not mapping
- [ ] Borrower not verified as msg.sender
- [ ] Arbitrary external calls allowed

---

## 7. Governance Vulnerabilities

### Detection Points
- [ ] Voting power via flash loan
- [ ] Missing timelock
- [ ] Permission bypass via remove+add

---

## 8. Upgrade Vulnerabilities

### Detection Points
- [ ] Storage layout conflicts
- [ ] Initialization function replay
- [ ] Proxy implementation bugs

---

## 9. Token Compatibility Issues

### Detection Points
- [ ] Fee-on-transfer tokens
- [ ] Rebasing tokens
- [ ] Non-standard ERC20 return values

---

## 10. Gas-Related Issues

### Detection Points
- [ ] Unbounded loops
- [ ] External calls in loops
- [ ] Large array operations