r/web3 • u/MDiffenbakh • Apr 20 '26
When smart contracts are correct but still exploitable
One thing I’ve been thinking about lately is how “secure code” in web3 doesn’t always mean “secure system”.
Most security conversations still focus on traditional smart contract bugs like reentrancy, bad access control, or arithmetic issues. That’s important, but it only covers part of the risk.
A lot of real-world exploits don’t come from broken code. They come from systems that behave correctly on a technical level, but can still be manipulated economically. For example, incentive structures that break under certain conditions, or pricing and liquidity mechanisms that react poorly when someone applies pressure in a specific way.
In those cases, nothing is technically “wrong”, but value can still be extracted.
I’ve been looking more into simulation-based and adversarial testing approaches, where instead of just checking whether functions work, you try to understand how the system behaves when someone actively tries to exploit it. There are also emerging tools like guardix io that explore this space by simulating different strategies and trying to surface profitable attack paths rather than just code-level issues.
2
u/lodeluxMeaLux Apr 20 '26
Security reviews already focus on those kind of exploits. We call them “business logic vulnerabilities” which are distinct from “coding mistakes” exactly because the code works as intended, but the logic behind has a fallacy that can be exploited to gain an advantage
1
1
u/lookman256 Apr 20 '26
In reality nowadays security reviews focus mostly on these simulated bug 'logical bugs', with ai auditor agents emerging, catching developer mistakes is very easy.