OWASP's Smart Contract Top 10 for 2025 ranks ten risk classes, led by access control vulnerabilities and price oracle manipulation. Use it as a review checklist, not a guarantee: a list of categories tells you where to look, and it says nothing about how bad any single bug will be.
The list
As published on the OWASP project page, the 2025 entries are:
- SC01 Access Control Vulnerabilities
- SC02 Price Oracle Manipulation
- SC03 Logic Errors
- SC04 Lack of Input Validation
- SC05 Reentrancy Attacks
- SC06 Unchecked External Calls
- SC07 Flash Loan Attacks
- SC08 Integer Overflow and Underflow
- SC09 Insecure Randomness
- SC10 Denial of Service Attacks
The page also keeps a tab for the 2023 edition, so check which version a vendor or auditor is quoting.
What each means for a reviewer
Access control. Who can call each sensitive function? Look for missing modifiers and for single keys that can do everything.
Oracle manipulation. Where does a price come from, and can one party move it? See our post on oracle manipulation defences.
Logic errors. The code does what it says, and what it says is wrong. Tests that encode the intended rules catch these.
Input validation. Treat every argument and every supplied account as hostile.
Reentrancy. An external call lets the callee re-enter before state is updated. Read reentrancy defenses compared.
Unchecked external calls. Ignoring a failed call result leaves the contract believing something succeeded.
Flash loans. Not a bug by themselves. They give attackers temporary capital to exploit other weaknesses such as oracles and governance votes.
Integer overflow and underflow. Largely handled by default since Solidity 0.8, but still relevant in older code and in unchecked blocks. See overflow before and after 0.8.
Insecure randomness. Anything predictable onchain, such as block values, can be gamed by someone who sees it first.
Denial of service. Loops over growing lists, or a dependency that can block a payout, can lock a function for everyone.
If you can only fix two things
Start with access control and oracle inputs. The first decides who can do damage. The second decides whether a stranger can feed your contract false facts. Both are cheap to review and expensive to get wrong.
Using the list in practice
- Turn each entry into one review question and a test.
- Record which entries are not applicable and why.
- Re-run the review when you change an upgrade path or add an external dependency.
- Pair it with static analysis and fuzzing, covered in our testing ladder post.
Safeguard's code and dependency scanning can cover the packages around a contract project, such as build tools and front-end libraries. A free scan is at gold.safeguard.sh/scan.
Quick check
Is the Top 10 a ranking of impact?
Treat it as a list of risk categories to review. The page itself does not make any one bug in a category more or less severe.
Why check the edition year?
The project page carries both a 2025 list and a 2023 tab, and they are not identical, so confirm which one a report refers to.
Sources
Last reviewed: 19 October 2026.
