Sigvex
EVMRemediation2 min read

Combined Attack Vectors Remediation

How to close chained exploits where individually minor findings combine into a critical attack path.

evmdefense-in-depth

Combined Attack Vectors Remediation

Overview

Related Detector: Combined Attack Vectors

Some exploits are not a single bug but a chain: a read-only reentrancy plus a stale price read, individually medium severity, combine into a flash-loan-funded price manipulation. Fixing one link often closes the whole path, but the robust remediation is defense in depth — remove more than one link so no single regression re-opens the attack.

There is no single code snippet; the fix is to break the chain at multiple points. For the common read-only-reentrancy + oracle chain:

// Link 1 — remove the reentrancy window: guard the state-mutating path.
modifier nonReentrant() { /* standard guard */ _; }

// Link 2 — remove the manipulable read: price from a manipulation-resistant
// source and reject reads taken mid-callback.
function price() public view returns (uint256) {
    return _twap(WINDOW);   // not spot, not get_virtual_price() during a callback
}

// Link 3 — bound the outcome: cap per-block state change / add slippage checks
// so even a partial chain cannot extract value.

Map each combo finding to its constituent links and fix at least two, so the exploit needs multiple independent regressions to return.

Common Mistakes

  • Fixing only the highest-severity link and assuming the chain is broken, when a variant re-routes around it.
  • Treating each finding in isolation during triage and never noticing they compose.
  • Adding a reentrancy guard but leaving a read-only path that a different contract can still exploit.

References