defi-amm-securitylisted

# DeFi AMM Security Vulnerability patterns with hardened counterparts for Solidity AMM contracts, LP vaults, and swap functions. ## Reentrancy: CEI ordering External call before state update lets a malicious token or receiver re-enter and drain. ```solidity // Vulnerable: effects after interaction function withdraw(uint256 amount) external { require(balances[msg.sender] >= amount); token.transfer(msg.sender, amount); balances[msg.sender] -= amount; } ``` ```solidity // Hardened: checks-effects-interactions + guard + SafeERC20 import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol"; import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol"; using SafeERC20 for IERC20; function withdraw(uint256 amount) external nonReentrant { require(balances[msg.sender] >= amount, "Insufficient"); balances[msg.sender] -= amount; token.safeTransfer(msg.sender, amount); } ``` OpenZeppelin's guard over a hand-rolled one; `SafeERC20` also handles non-standard tokens that return no bool. ## Donation / inflation attack Share math based on raw `token.balanceOf(address(this))` lets an attacker inflate the denominator by sending tokens directly to the contract, skewing share prices (classic first-depositor / vault-inflation exploit). ```solidity // Vulnerable: balanceOf as denominator function deposit(uint256 assets) external returns (uint256 shares) { shares = (assets * totalShares) / token.balanceOf(address(this)