Smart contract risk

The vectors form a stable taxonomy. Reentrancy, the classic case of The DAO. Access-control errors, with unprotected admin functions or compromised governance keys. Logic and arithmetic errors, such as overflows before Solidity 0.8 or mispriced calculations. Oracle manipulation via flash loans. Bugs in upgrades and proxies, with faulty initialization or storage collision. And dependency risk, when a bridge or shared library fails.

Why it matters for technical due diligence. Before moving capital into a protocol it is worth checking whether it is audited and by whom (firms such as Trail of Bits, OpenZeppelin, Certik or Cyfrin), whether the code is verified and open source, whether admin functions have a timelock and multisig, whether the contract is immutable or upgradeable, since an upgradeable proxy adds admin risk, and whether an active bug bounty exists on platforms like Immunefi. Regulated frameworks reinforce issuer transparency, but they do not replace a technical review of the contract itself.