Business Logic Vulnerabilities in Smart Contracts

By the Guardian team Updated November 2026 5 min read

Quick answer. Business logic vulnerabilities are flaws where code runs as written but breaks the protocol’s own rules, like miscounted shares or forgiven debt. Tools miss them because the rules live in the spec, not in a code pattern.

Watch: Business Logic Vulnerabilities in Smart Contracts 1:41

Video transcript

Most Critical bugs in Guardian's audits are not textbook exploits. The code runs as written, but breaks the protocol's own rules.

Guardian's public reports hold 343 Critical findings, and 58.3 percent are labeled Logical Error. Only two are labeled Reentrancy.

These flaws rank second in OWASP's 2026 Top 10. They show up as broken accounting, operations in the wrong order, profitable incentives, blocked withdrawals, edge states and cross-module trust.

In Guardian audits, Synthetix Perps V3 zeroed debt before counting the excess payment. Olympus used the wrong decimals, so users could receive a billion times more OHM than intended.

Static analyzers match known code patterns. A logic bug has none, because the spec is not in the code.

One AI tool maker is candid about the gap. Across 29 audits, Nethermind's AuditAgent found 30 percent of what its auditors found.

To find them, write the rules down as invariants and fuzz them. Start from empty pools, try actions in every order, and re-run on every change.

Vanguard puts two independent teams on the same scope. Team A pairs expert manual review with an invariant suite. Team B is driven by Helix, Guardian's AI auditor, and only human-verified findings reach the report.

Vanguard also adds a Defender contest and six months of update review. Read the full article, or get a quote at guardian.security.

In Guardian’s audits, most Critical bugs are not textbook exploits.

Guardian’s public portfolio holds 343 Critical findings across 320 reports. 58.3% are labeled Logical Error, and two are labeled Reentrancy.

OWASP’s 2026 Smart Contract Top 10 ranks business logic vulnerabilities second, after access control.

What Counts as a Logic Bug

OWASP describes these as flaws where a contract’s intended economic or functional behavior can be subverted. Low-level checks, such as reentrancy guards and access control, can all be correct.

Guardian’s reports use the label Logical Error for a protocol breaking its own rules. The common shapes:

Accounting: shares, debt, fees or rewards that stop matching the assets behind them.
Order of operations: a value overwritten before it is used.
Incentives: an allowed action that pays its caller more than it costs.
Availability: liquidations, withdrawals or claims that can be blocked for good.
Edge states: first deposits, empty pools, zero-size orders and partial closes.
Cross-module trust: one contract or chain trusting what another reports.

By title, the largest groups of Guardian Criticals describe something blocked or stuck (60), then fees, rewards, vesting or claims (38).

Shares, debt or double counting (33) and funds drained (31) come next.

These counts use the method of Guardian’s critical findings report. That report counted 337 reports and 360 Criticals, before 17 reports left the portfolio.

Examples by Protocol Type

Each is a Critical from a public Guardian report, and each was resolved.

Lending

Sentiment V2 (C-02): the health check counted newly borrowed assets as collateral when both were the same token.

A pool owner could set the LTV to 1 and borrow the whole pool without posting collateral, freezing depositors’ funds.

Perpetuals

Synthetix Perps V3 (C-01): payDebt set the debt to zero before working out how much of the payment was excess.

Repaying 1 wei more than the debt wiped it out and credited the full payment as collateral.

Liquidation incentives

Synthetix BFP Market, Round 2 (C-01): nothing required a deposit to cover the liquidation reward.

A user could deposit 1 wei and liquidate themselves, for about $11.65 profit at the report’s ETH price.

AMMs

Poolshark Limit (TK-1): one path stored pool liquidity on a tick without zeroing it, so crossing that tick doubled the pool’s liquidity.

Swaps then drew tokens from far-away positions, and LPs could not burn their positions.

Fee distribution

Abracadabra PurrSwap (C-01): LP token transfers did not update the receiver’s fee index.

The same backlog of fees could be claimed again from each new address until the contract was drained.

Vaults

Jones DAO jGM (C-06): leveraged deposits minted shares on the borrowed amount as well as the deposit.

They got more shares per asset than unleveraged depositors, and could withdraw the excess at others’ expense.

Token minting

Olympus Convertible Deposits (C-01): conversion scaled by the reserve token’s decimals instead of OHM’s.

With an 18-decimal reserve token, users would receive 1 billion times more OHM than intended.

None of these needs an exotic trick. Each is code that does exactly what it says, where what it says is wrong.

When a trust assumption fails

Invariants also limit damage when something else breaks. Resolv’s minting contract checked only that a valid signature existed, Chainalysis found, as quoted by rekt.news.

In March 2026, attackers took control of that signing key and minted 80 million unbacked USR. Rekt.news reports about $25 million in ETH reached one attacker wallet.

Nothing onchain capped what could be minted.

Why Tools Miss Them

Static analyzers look for known patterns: a missing modifier, an unchecked call, a reentrancy shape.

A logic bug has no pattern. Every line is valid; the bug is the gap between the code and what the protocol promised.

The spec is not in the code. A tool cannot know debt should fall only on repayment unless someone writes it down.
The bug is in the sequence. Synthetix’s flaw was two plausible lines in the wrong order.
The bug needs a state. Many appear only at a first deposit, an empty pool or a partial close.
The bug is economic. A 1 wei deposit and a self-liquidation are both allowed; only the payoff is wrong.

One AI tool maker is candid about this gap. Across 29 audits, Nethermind’s AuditAgent found 30% of what its auditors found.

Nethermind says the tool “can improve in identifying context-specific vulnerabilities where understanding system logic is critical.”

See our guide to AI auditing tools.

How Logic Bugs Are Found

Write the rules down. Shares match assets, debt falls only on repayment, mints never exceed backing.
Make them executable. Turn each rule into an invariant and fuzz it across every reachable state.
Start from empty. Fuzz first deposits and empty pools, not only a funded steady state.
Review against the spec. Read each function against what the docs promise, not only for known bug classes.
Attack the sequences. Deposit, transfer, claim. Open, partially close, liquidate. Try every order.
Price every action. Check whether any allowed action pays its caller more than it costs.
Cap the blast radius. Put onchain limits on mints and withdrawals.
Re-run on every change. Keep the suite as a regression harness for each update.

OWASP’s own examples include “Total value withdrawn cannot exceed total deposits + realized yield.” For accounting bugs in depth, see DeFi accounting vulnerabilities.

Updates need the same care: 10 of 43 published Guardian update reviews contain a Critical. See Critical bugs in post-launch updates.

How Vanguard Finds Them

Guardian’s flagship audit, Vanguard, puts two independent teams on the same scope, and each cross-checks the other.

Team A uses expert manual review and an exhaustive invariant suite. Guardian writes the protocol’s core safety properties as executable invariants, then pressure-tests every reachable state against them.

The suite covers accounting, rounding, solvency, math formulas and edge states. It outlives the audit as a reusable harness for every change.

Team B is driven by Helix, Guardian’s AI auditor, which searches the entire codebase. Humans verify the context, configuration and depth, and only human-verified findings reach the report.

Guardian’s smart contract audit also reviews the design and its economic assumptions before implementation locks in the costliest risks.

After the audit, Vanguard adds a $100,000 Defender contest and six months of update review.

Frequently Asked Questions

What is a business logic vulnerability in a smart contract?

A flaw where the code runs as written but breaks the protocol’s intended rules, such as miscounting shares, forgiving debt or paying rewards twice. OWASP ranks business logic vulnerabilities second in its 2026 Smart Contract Top 10.

Why don’t static analysis tools catch logic bugs?

Static analyzers match known code patterns. A logic bug is valid code that contradicts the protocol’s specification, which the tool never sees. Invariants written from the spec give tools something to check.

How common are logic bugs in smart contract audits?

In Guardian’s 320 published reports, 58.3% of the 343 Critical findings are labeled Logical Error. Two are labeled Reentrancy.

How do you test for business logic vulnerabilities?

Write the protocol’s rules as invariants and fuzz them from empty and first states. Review each function against the spec, try adversarial sequences of actions, and re-run the suite on every change.

Sources

Find the logic bugs before launch

Vanguard puts two independent teams and an invariant suite built from your protocol’s own rules on your code.

Get a Vanguard quote Explore Vanguard