Access control in a smart contract is the set of rules that decides who is allowed to invoke which state-changing operation. An access control vulnerability exists when a privileged function-one that moves funds, mints tokens, changes ownership, upgrades logic, pauses the system, or destroys the contract-can be called by an account that should never have been permitted to call it.

Price Oracle Manipulation occurs when a smart contract makes a financial decision-how much to lend, mint, redeem, or liquidate-based on a price it reads from a source an attacker can move within the same transaction. The attacker distorts that price, trades against the contract while it is looking at the distorted value, and extracts the difference.

Logic Errors (also called business-logic flaws) occur when a smart contract compiles cleanly, passes its happy-path tests, and appears to "work"-yet its implemented behaviour diverges from its intended behaviour. There is no memory-safety bug, no reentrancy, no missing access-control modifier; the code simply computes the wrong thing.

Lack of Input Validation occurs when a smart contract trusts caller-supplied parameters - addresses, amounts, arrays, indexes, IDs, fees, deadlines, or raw calldata - and acts on them without checking that they are within the values the logic actually expects. On a public blockchain anyone can call your functions with any arguments the ABI permits, so every unvalidated parameter is an open control that an attacker can turn to a value you never intended.

Reentrancy is a class of smart-contract vulnerability in which a contract makes an external call-sending ETH or invoking another contract-before it finishes updating its own state. The called party can then call back ("re-enter") into the original function while it is still mid-execution, observing and acting on stale state that has not yet been written back.

Unchecked External Calls occur when a smart contract makes a low-level call to another address-to send ether, invoke a function, or move tokens-and then ignores whether that call actually succeeded. The contract continues executing as if the interaction worked, updating balances, marking payments complete, or emitting success events, even though the external operation may have silently failed.

A flash loan is an uncollateralised loan that must be borrowed and repaid within a single transaction. Because the Ethereum Virtual Machine executes a transaction atomically-every state change either commits together or reverts together-a lending protocol can safely hand an attacker millions in tokens with no collateral: if the loan plus its fee is not returned by the end of the same transaction, the entire transaction reverts as if it never happened.

Integer overflow and underflow occur when an arithmetic operation produces a result outside the range a fixed-size integer can hold, so the value wraps around modulo 2n instead of being the mathematically correct number. On the EVM every integer is fixed-width-uint256 holds 0 to 2256−1, uint8 holds 0 to 255-and there is no arbitrary-precision fallback.

Insecure Randomness occurs when a smart contract derives a "random" number from on-chain values that are predictable or manipulable. The contract treats data such as block.

Denial of Service (DoS) in a smart contract means making the contract-or a critical function within it-permanently or temporarily unusable, or locking funds so no one can withdraw them. Unlike a web DoS, which floods a server and ends when the traffic stops, an on-chain DoS is often permanent: once a contract is wedged into a broken state, immutable code has no "restart" button.