OWASP Smart Contract Top 10 for 2026, With Real Exploits

By the Guardian team Updated November 2026 6 min read

Quick answer. The OWASP Smart Contract Top 10 for 2026 was released on February 10, 2026. It ranks access control, business logic, oracle manipulation, flash loans, input validation, external calls, arithmetic, reentrancy, overflow and upgradeability.

Watch: OWASP Smart Contract Top 10 for 2026, With Real Exploits 1:39

Video transcript

The OWASP Smart Contract Top 10 for 2026 ranks the most serious risks in contract code. Here are all ten, with real exploits.

OWASP ranks mainly by practitioner survey. Its incident data covers 122 protocols and 905.4 million dollars of 2025 losses, from contract vectors only.

First come access control, business logic, oracle manipulation, flash loans, and input validation. Flash loans rose from seventh to fourth.

Then external calls, arithmetic, reentrancy, integer overflow, and upgradeability. Arithmetic and upgradeability are new entries.

Losses do not follow rank. Integer overflow caused the most, 260.4 million dollars, mostly from Cetus, yet it ranks ninth.

Each risk maps to a real exploit. Cork lost about 11 million dollars to an open hook. GMX V1 lost 42 million to reentrancy. Guardian audits found the same patterns.

Some gaps sit outside the ten. Keys and signers, denial of service, signatures, and front-running all need their own testing.

Use the list across your lifecycle. Design a permission matrix, build fuzzed invariants, test bad inputs, review for coverage, then timelock upgrades and monitor.

A checklist will not find logic bugs. Read the full article, or talk to Guardian at guardian.security.

The OWASP Smart Contract Top 10 ranks the most serious risks in smart contract code.

This guide uses the 2026 edition, released on GitHub on February 10, 2026. It is the latest release, and OWASP's Smart Contract Security site lists it as current.

The project page on owasp.org still showed the 2025 list when we checked on November 5, 2026.

Each risk below gets one real exploit and one finding from a public Guardian audit.

About the 2026 List

OWASP calls the list forward-looking. Its ranking is "primarily driven by practitioner survey mean rank," with incident data as a check.

That data covers 122 protocols and $905.4M of 2025 losses. It counts contract vectors only, leaving out phishing, exchange breaches, rug pulls and private key compromises.

#	Risk	2025 edition	2025 losses	Go deeper
SC01	Access control	1	$220.0M	Access control data
SC02	Business logic	3, as logic errors	$188.7M	Business logic
SC03	Price oracle manipulation	2	$20.7M	Oracle manipulation
SC04	Flash loan facilitated attacks	7	$27.8M	Flash loan attacks
SC05	Lack of input validation	4	$4.1M	Vulnerabilities list
SC06	Unchecked external calls	6	$0.55M	External call attacks
SC07	Arithmetic errors	New	$138.1M	Rounding errors
SC08	Reentrancy	5	$42.1M	Reentrancy attacks
SC09	Integer overflow and underflow	8	$260.4M	Sneaky Solidity bugs
SC10	Proxy and upgradeability	New	$2.9M	Upgradeable contracts

Losses do not follow rank. Integer overflow led 2025 at $260.4M, mostly from Cetus.

Insecure randomness and denial of service left the list. Flash loan attacks rose from seventh to fourth.

Risks 1 to 5

SC01: Access Control

A contract fails to enforce who may call privileged functions.

Exploit: Cork Protocol, May 28, 2025, about $11M. Its Uniswap v4 hook lacked an onlyPoolManager check, so anyone could call it (Dedaub).
Guardian finding: Gamma's limit order hook left beforeSwap and afterSwap open to any caller (C-06, Critical, resolved).

SC02: Business Logic

The code runs as written but breaks the protocol's own rules, even when every low-level check is correct.

Exploit: Abracadabra, March 2025, 6,260 ETH (about $13M). A deliberately failed GMX deposit let the attacker borrow against collateral that no longer existed (Halborn).
Guardian finding: Baseline Markets never locked claimed collateral, so users could withdraw it and leave the debt unpaid (C-04, Critical, resolved).

SC03: Price Oracle Manipulation

A contract trusts a price an attacker can move.

Exploit: NGP on BNB Chain, September 18, 2025, about $2M. Its getPrice() read one PancakeSwap pair's reserves, which a flash loan distorted (SolidityScan).
Guardian finding: A Peapods oracle priced spTKN from a raw token balance, so a donation inflated collateral value (C-03, Critical, resolved).

SC04: Flash Loan Facilitated Attacks

Uncollateralized capital, repaid in one transaction, scales a small bug into a drain.

Exploit: Bunni, September 2, 2025, about $8.4M. A 3M USDT flash loan scaled a rounding error in withdrawals (Bunni).
Guardian finding: Peapods charged its flash mint fee to the receiver, so one large flash mint could burn another contract's entire pTKN balance (C-12, Critical, resolved).

SC05: Lack of Input Validation

External data is used without checking that it is well formed and in bounds.

Exploit: Ionic Money on Mode, February 4, 2025, $6.9M (Rekt; DefiLlama says up to $8.8M). Lombard Finance impersonators got a counterfeit LBTC listed as collateral.
Guardian finding: Veranta accepted oracle payloads with no exponent field, inflating prices by a factor of 1e8 (C-01, Critical, resolved).

Risks 6 to 10

SC06: Unchecked External Calls

A contract calls another without handling its failure, return data or callback.

Exploit: Arcadia Finance on Base, July 15, 2025, nearly $3.5M (SolidityScan; DefiLlama: $2.5M). An unvalidated router address let the attacker act with the Rebalancer's trust.
Guardian finding: GMX loaded a callback's revert data into memory, so huge revert data could make order execution run out of gas (CBU-1, Critical, resolved).

SC07: Arithmetic Errors

Rounding and precision mistakes in share, interest and price math.

Exploit: zkLend on Starknet, February 2025, $9.57M. After inflating a lending accumulator, repeated deposits and withdrawals rounded in the attacker's favor (Halborn).
Guardian finding: Baseline Markets always rounded down when denormalizing, so dust trades could collapse the pool's safe price (C-02, Critical, resolved).

SC08: Reentrancy

An external call re-enters the contract before its state is updated.

Exploit: GMX V1, July 2025, $42M. Reentrancy in executeDecreaseOrder left a stale average short price that inflated GLP (Halborn).
Guardian finding: A Yuga Labs royalty splitter let its first recipient re-enter withdraw() and take the others' shares (C-01, Critical, resolved).

SC09: Integer Overflow and Underflow

Values wrap or truncate past a type's limits, especially in unchecked code or on non-EVM chains.

Exploit: Cetus on Sui, May 22, 2025, about $223M. A flawed overflow check let a left shift silently drop high bits (Dedaub).
Guardian finding: A FastLane percentage could exceed a uint16, reverting the crank and locking funds (H-03, High, resolved).

SC10: Proxy and Upgradeability

Weak initialization, upgrade or admin controls on upgradeable contracts.

Exploit: Kinto, July 10, 2025, $1.55M. An attacker had initialized fresh proxies with a hidden backdoor, then upgraded them and minted K tokens (Audita).
Guardian finding: Aria's Legal contract inherited two contracts that both stored data at slot 0, so blacklist writes corrupted the license version (H-01, High, resolved).

What the List Leaves Out

The Top 10 covers contract code. OWASP names some of these gaps only as honorable mentions, outside the ten.

Keys and signers. OWASP's loss data excludes private key compromises. See where hack losses came from.
Denial of service. Now an honorable mention, yet the second most common label on Guardian's public Criticals: 40 of 343.
Signatures and replay. An honorable mention, not a ranked risk. See signature malleability.
Front-running and MEV. Also an honorable mention. See front-running attacks.

Using the List in Your SDLC

Design: write a permission matrix and list every price source before coding.
Build: encode accounting, rounding and solvency rules as invariants, and fuzz them.
Test: add negative tests for bad inputs, unprivileged callers and flash-loan-sized balances.
Review: use the ten as a coverage check, not as the audit scope.
Upgrade: initialize proxies in the deploying transaction and timelock every upgrade.
Operate: monitor privileged calls, upgrades and price deviations. See onchain monitoring.

A checklist will not find logic bugs. They break rules that live in the spec, not in a code pattern.

How Guardian Covers the Ten

Every finding above comes from a public Guardian report. Browse them all in the audit portfolio.

Guardian's smart contract audit runs three passes: a design review, an invariant suite around solvency, accounting and rounding, and senior manual review.

Vanguard adds a second team driven by Helix, Guardian's AI auditor, plus six months of update review. See all audits and pentests.

Frequently Asked Questions

What is the OWASP Smart Contract Top 10 for 2026?

OWASP's ranked list of the ten most serious smart contract risks, released February 10, 2026. It runs from access control and business logic to reentrancy, integer overflow and proxy upgradeability, ranked mainly by a practitioner survey.

What changed from the 2025 edition?

Arithmetic errors and proxy and upgradeability vulnerabilities are new. Insecure randomness and denial of service dropped out. Logic errors became business logic vulnerabilities, flash loan attacks rose from seventh to fourth, and reentrancy fell from fifth to eighth.

Is the OWASP list ranked by losses?

No. OWASP ranks mainly by practitioner survey, with incident data as a check. In its 2025 data, integer overflow caused the most losses, $260.4M, yet it ranks ninth.

Does covering the Top 10 make a contract secure?

No. It names common risk classes, not a full review. Protocol-specific logic, signatures, MEV and the keys and systems around the contracts all need their own testing.

Sources

Check your code against all ten, and what the list misses

Guardian's audits pair an invariant suite with senior manual review, so logic and upgrade risks get the same depth as the classics.

Get a quote Explore audits and pentests