Smart Contract Vulnerability Examples: Search 9,617 Findings
Quick answer. Guardian's public portfolio lists 9,617 real findings from 320 audit reports, with code locations, descriptions, recommended fixes and statuses. Search them by bug class, such as reentrancy, oracle or access control.
Video transcript
Want real smart contract bugs, with code locations and fixes? Guardian's public portfolio has thousands, all searchable.
The portfolio holds 9,617 findings from 320 public audit reports, including 343 Criticals and 845 Highs.
Nearly every finding gives a code location, a description, a recommended fix and a status. About one in seven links the fix itself.
Logical errors lead, with 2,175 findings and 626 Criticals and Highs. Validation is second, and the guide links a real example of each.
Labels overlap, though. A search for oracle returns 242 findings, but only 71 carry the Oracle label.
One box searches reports and findings. Every word must match, matching is literal, and even a hyphen changes results. Criticals come first, and filters narrow by chain and language.
Name the precondition, like Impermax's callback running before the debt was recorded. Search your code for that shape. Turn the attack into a test, read the fix, and check the status.
For new code, Vanguard, Guardian's enterprise audit, puts two independent teams on one scope. One does manual review and fuzzing, the other is powered by Helix, Guardian's AI auditor.
Read the full guide, or get a Vanguard quote from the team behind these findings at guardian.security.
The fastest way to learn a bug class is to read real instances of it: the vulnerable code, the impact and the fix.
Guardian publishes its public audit reports in its portfolio, broken down to individual findings. All of them are searchable.
This guide covers what the portfolio holds, where to start by category, and how to search it.
What You Can Search
The portfolio holds 320 public reports for 99 clients, dated March 2022 to October 2026. Together they contain 9,617 findings:
- Critical: 343
- High: 845
- Medium: 2,133
- Low: 4,234
- Informational: 2,062
Most are smart contract reviews. Five reports, with 192 findings, cover offchain systems rather than smart contracts.
Each finding carries:
- A code location (97.2% of findings).
- A description of the bug (all but 3).
- A recommendation for the fix (99.9%).
- A status, plus the team's response in about half (49.4%).
- A link to the fix, usually a pull request or commit (14.6%).
Examples by Category
Reports label nearly every finding with a category. The table counts ten of them and links a real example of each.
| Category | Findings | Critical and High | Example |
|---|---|---|---|
| Logical Error | 2,175 | 626 | Veranta C-02: partial closes erase accrued fees |
| Validation | 1,117 | 87 | Gamma Strategies H-03: a creator-supplied factory can siphon launch tokens |
| DoS | 653 | 165 | Clanker H-01: forced ETH bricks every launch |
| Rounding | 177 | 18 | Baseline Markets C-02: one-way rounding can collapse the pool price |
| Access Control | 134 | 30 | Buttonwood C-02: an open callback mints tokens with zero collateral |
| Gaming | 129 | 35 | Synthetix C-01: a 1 wei deposit makes self-liquidation profitable |
| Oracle | 71 | 5 | Perp City H-10: markets keep running on a stale index price |
| Frontrunning | 50 | 12 | Magnify Cash C-02: a desk owner front-runs a loan to raise its interest |
| Reentrancy | 44 | 6 | Impermax C-01: a borrow callback redeems the collateral |
| Signatures | 31 | 1 | Sapience C-01: signatures without a nonce can be replayed |
Counts use each report's own label. We merged only spellings of the same label, such as Logic Error and Logical Error, or DoS and Denial-of-Service.
Labels overlap, so treat the counts as a guide. A search for oracle returns 242 findings, but only 71 carry the Oracle label.
Each category name opens a search for it. These searches cut across categories:
- liquidation: 234 findings, 58 of them Critical or High
- stale: 186 findings, 14 Critical or High
- slippage: 80 findings, 12 Critical or High
- donation: 54 findings, 10 Critical or High
- flash loan: 22 findings, 2 Critical or High
How Search Works
One box on the portfolio searches reports and findings. Results split into a Reports tab and a Findings tab.
- Every word must match. Each must appear in the finding's ID, title, category, client or report title.
- Matching is literal.
frontrunalso finds frontrunning, but front-run is a separate spelling. - Hyphens count.
re-entrancyfinds nothing;reentrancyfinds 78. - Most severe first. The list shows up to 200, Criticals at the top. Add a word to narrow it.
- Links keep the search. The query stays in the URL, so a search can be shared.
Filter by chain and language
Filters narrow the reports by sector, chain and language. Finding results follow the reports you keep.
The largest chains are Arbitrum (145 reports), Ethereum (134) and Base (64). Solana has 40.
Solidity covers 289 reports and Rust 17.
A report with no chain tags of its own takes its client's. Filters stay in the URL too: DoS in Rust reports returns 36 findings from 10 reports.
Severity and status
The hub has no severity filter; finding results already sort by severity.
Inside a report, severity buttons filter its findings. A status menu appears when they carry more than one status.
Reading a Finding Page
Take Impermax C-01, a Critical from Guardian's February 2025 review of Impermax V3.
Its row shows the ID, severity, title (Collateral-Free Borrows), category (Reentrancy) and status (Resolved). Opening it shows four parts:
- Location:
ImpermaxV3Borrowable.sol. - Description: a six-step attack. The borrow callback runs before the debt is recorded, so the borrower redeems the collateral mid-borrow.
- Recommendation: the collateral contract must hold the collateral while a borrow is active.
- Resolution: the team's response, linking the fix commit.
A "Link to C-01" button copies the finding's address. Multi-round reports show which round raised it, and every page links the full PDF on GitHub.
Using Examples in Your Reviews
Reading findings works best with a method. For each example:
- Name the precondition. At Impermax, an external call ran before the debt was recorded.
- Search your code for it. Look for the same shape: callbacks, unchecked callers, one-way rounding.
- Write the test. Turn the attack into a unit test or invariant, so the fix stays fixed.
- Read the fix, not just the bug. Sapience H-01 records a fix that rounded opposite to the recommendation.
- Check the status. An acknowledged finding may still be live.
What each status means is in Acknowledged vs Resolved: Audit Finding Statuses Explained.
For the reasoning behind six past findings, see 6 Smart Contract Audit Findings Explained. For a checklist of bug classes, see the smart contract vulnerabilities list.
How Guardian Publishes Findings
Every report in the portfolio is public, with each finding, recommendation and resolution, and the full PDF.
The PDFs also live in Guardian's public Audits repository on GitHub.
For new code, Vanguard, Guardian's enterprise audit, puts two independent teams on one scope.
One works by manual review and fuzzing. The other is powered by Helix, Guardian's AI auditor.
It also leaves an invariant suite that outlives the audit, so fixes and later changes can be retested. See Guardian's smart contract audit for the full scope.
Frequently Asked Questions
Where can I find real examples of smart contract vulnerabilities?
Guardian's public portfolio lists 9,617 findings from 320 audit reports. Nearly all give a code location, description, recommendation and status, and about one in seven links the fix. Search it by bug class, such as reentrancy or oracle.
How do I search audit findings by vulnerability type?
Type the bug class into the portfolio search, for example frontrun or access control. Every word must appear in the finding's ID, title, category, client or report title. Results list the most severe findings first.
Can I filter findings by blockchain or language?
Yes. Filters narrow the reports by sector, chain and language, and finding results follow. Arbitrum has 145 reports, Ethereum 134 and Solana 40. Solidity covers 289 reports and Rust 17.
What is the most common vulnerability category in audits?
In Guardian's public reports it is Logical Error: 2,175 of 9,617 findings, including 626 Criticals and Highs. Validation is second, with 1,117 findings.
Sources
- Guardian: Public audit portfolio, 320 reports and 9,617 findings (as of November 6, 2026)
- GitHub: GuardianAudits/Audits, the published report PDFs
- Guardian: Veranta V2 Review (October 26, 2026)
- Guardian: Gamma Strategies Unilaunch Launchpad and Limit Order Book (March 5, 2026)
- Guardian: Clanker Protocol Review (August 5, 2026)
- Guardian: Baseline Markets AMM, Round 2 (December 30, 2025)
- Guardian: Buttonwood Cash (October 1, 2025)
- Guardian: Synthetix BFP Market, Round 2 (October 28, 2024)
- Guardian: Perp City Protocol Review (August 7, 2026)
- Guardian: Magnify Cash NFT Lending Protocol (March 14, 2024)
- Guardian: Impermax V3 (February 8, 2025)
- Guardian: Sapience Foil Vault and Prediction Market (October 31, 2025)
- Guardian: Sapience Foil Vault (January 13, 2025)
- Guardian: Vanguard audit
Get your code reviewed by the team behind these findings
Vanguard puts two independent teams on your scope and leaves an invariant suite to retest every fix.