A01:2021WEB
Broken Access Control
Server fails to verify permissions — users access data and actions they shouldn't.
BEGINNER
An offensive playground. Break things on purpose, in a sandbox, so you don't break them by accident in production.
Server fails to verify permissions — users access data and actions they shouldn't.
Weak crypto, plaintext storage, or exposed key material leaks sensitive data.
Untrusted input is concatenated into a query — attackers rewrite the query.
Weak credentials, missing MFA, or broken session handling let attackers walk in.
Attackers make the server fetch internal resources it should never touch.
Privileged contract functions exposed without onlyOwner / role checks.
Edge cases in DeFi math, fees, or vesting that violate intended invariants.
Spot price reads from a single AMM are pumped to fool collateral checks.
Atomic, capital-free borrows weaponize tiny edge cases at massive scale.
Public methods accept arbitrary addresses, amounts, calldata without checks.
Ignoring .call() return values silently drops failures and corrupts state.
Off-by-one, rounding, and unit confusion bleed value from the protocol.
External call before state update — attacker re-enters and drains the vault.
Pre-0.8 Solidity rolls past type bounds — balances become astronomical.
Storage-slot collisions in proxies turn an upgrade into a takeover.