https://github.com/singularity0x00/dvdefi_exploits
Solving Damn Vulnerable Defi Challenges
https://github.com/singularity0x00/dvdefi_exploits
Last synced: 3 months ago
JSON representation
Solving Damn Vulnerable Defi Challenges
- Host: GitHub
- URL: https://github.com/singularity0x00/dvdefi_exploits
- Owner: Singularity0x00
- Created: 2024-07-24T02:46:44.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2024-10-19T16:37:26.000Z (almost 2 years ago)
- Last Synced: 2025-04-12T17:25:08.024Z (over 1 year ago)
- Language: Solidity
- Size: 23.4 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# Damn Vulnerable DEFI Solutions
# Side_Entrance
> `flashloan()` function only checks that balance after loan is same as balance before.
Function `deposit()` updates the mapping and associates the amount deposited with the exploit address, This behaviour can be exploited such that we can take entire balance of lenderpool as flashloan from the `flashloan()` function and use the deposit function to repay the loan Contract now thinks it's entire balance is associated to exploit contract's address. and thus can be withdrawn via exploit contract.
# Unstoppable
transfer any amount of tokens to vault contract. This should break `convertToShares(totalSupply) != balanceBefore)` check and break the flash loan functionality.
# Truster
`flashloan()` function executes an unsafe external call `target.functioncall(data)` where address (`target`) and data (`data`) are directly controlled by an attacker basically giving you complete ownership for that one call. This can simply be exploited by calling token contract and approving attack contract for all the funds then simply tranfer them to recovery.
# Selfie
It's called `emergencyExit` but you gotta wait 2 days? how stupid is that?!
The protocol uses `ERC20votes` to calculate voting power.
`SimpleGovernance::_hasEnoughVotes()` function is used to check whether a contract can set up an action in `queueAction()` function. However, `_hasEnoughVotes()` can be bypassed if we are able to get enough tokens, This is where pools flashloan function can be leveraged.
Step 1: Get a flashloan of all tokens in pool for exploit contract.
Step 2: use token's `delegate()` function to get voting power. **1:1 votes to tokens ratio**
Step 3: Call `SimpleGovernance::queueAction()` function to set up an actions which calls `SelfiePool::emergencyExit()` function to recovery address, And return flashloan.
Step 4: warp 2 days and call `SimpleGovernance::executeAction()`