contract vulnerability