Smart contract security glossary

Classic reentrancy re-enters a state-changing function while state is stale. Read-only reentrancy changes nothing at all — a view function is queried during a callback while the contract sits in an intermediate state, and returns a value that is simply wrong. The victim is usually a different protocol that integrated with it and has no guard, because it never writes anything.

An audit is a time-boxed adversarial review of a fixed commit by a dedicated security team, producing a report. A bounty is an open, ongoing offer to pay for findings. They search differently: an audit covers the whole scope systematically, a bounty optimises for whatever is cheapest to find. Use both.

Impact is what happens if the flaw is exploited — total loss, bounded loss, degraded function. Likelihood accounts for preconditions: capital required, privileged access needed, market conditions, and whether it is one transaction or a sequence someone can interrupt. A catastrophic impact with negligible likelihood is not a Critical.

Because integer arithmetic has no fractions, so every division discards something, and every discarded fraction goes to one side of a trade. Over enough operations, and on a chain where a transaction costs a fraction of a cent, “it is only a wei” stops being true.

The concepts are; the exact wording is ours. Where a term has a formal standard behind it — EIP-1967, ERC-4626, EIP-55 — we follow the standard. Where the industry uses a term loosely, we say how we use it, which is more useful than pretending there is a canonical definition.