Across the audits we ran last year, the same handful of issues accounted for the majority of high-severity findings. None of them were exotic.
Access control drift
Contracts start with a clean owner model and accumulate privileged functions. By deployment, nobody can enumerate what the owner key can actually do.
Unchecked external calls
Every external call is a re-entrancy surface and a failure mode. Checks-effects-interactions is old advice because it keeps being necessary.
Economic assumptions
The subtlest bugs are not memory-safety issues, they are incentive bugs: oracle manipulation, sandwichable ordering, and rounding that always favours the same party.
