Smart contract security guides

Worked examples of the vulnerability classes that show up most often in Solidity and Rust/Anchor code. Every code sample is taken from the fixture set Weakspot is tested against, not written for the article.

• Reentrancy in Solidity, and why withdraw() is where it lives

  The checks-effects-interactions violation, walked through on a real vault contract — attack sequence included.

• The missing signer check, Solana's most expensive one-line bug

  AccountInfo where Signer belonged — the Anchor equivalent of forgetting onlyOwner, and just as exploitable.

• Division before multiplication, and how it silently returns zero

  A one-line ordering mistake in a staking pool that pays every user exactly nothing. No revert, no error.

• Missing access control, the bug that reads like working code

  The contract declares an owner and then forgets to use it. A worked example on a fee treasury.

• Why tx.origin is never an authorization check

  One word turns an owner-only function into one that any contract the owner visits can trigger.

• send(), transfer(), call() — and the refund that silently fails

  The compiler warns, the tests pass, and an outbid bidder never sees their ETH again.

• Why AI audits hallucinate, and what actually fixes it

  48 findings down to 7, of which 1 was real. What that number says about every AI auditor, including this one.