Anyone With $5 of Gas Can Attack You

Why this matters

Smart-contract security is unique because the attacker is universal (anyone with $5 of gas), the system is permissionless (no IP allowlists), and the cost-of-failure is paid in capital you can't claw back. An attacker who finds a bug doesn't need to ship a phishing campaign — they just call your function. The threat model is 'every economically-rational actor on Earth, with access to flash loans up to your TVL'.

Demo

Same contract, two readers: a developer sees 'a function that pulls funds from a pool'; an auditor sees 'a function with an external call, a state update after the call, and no reentrancy guard — exploitable for the pool's full balance in one transaction.'

Try it yourself

1. REPRODUCE — pick a recent rekt.news entry. Trace the exact tx that drained the protocol. Note the gas cost, the attacker's profit, and the time from deploy to drain.
2. PATCH — read the post-mortem. Identify the single line of code that, if changed, would have stopped the attack. Most are a missing modifier or a swapped order of operations.
3. VERIFY — for the same protocol, write the invariant the attack violated (e.g. 'sum of user balances == contract token balance'). That's the test the team didn't write.

References

• rekt.news leaderboard
• Solodit (audit findings aggregator)