A surprisingly simple pool allows anyone to deposit ETH, and withdraw it at any point in time.It has 1000 ETH in balance already, and is offering free flash loans using the deposited ETH to promote their system.Starting with 1 ETH in balance, pass the challenge by taking all ETH from the pool. Challenge #4 – […]
Side Entrance | Damn Vulnerable DeFi #4 Walk-Through Read More »
Unlock the vault to win the level. It’s set to locked and password protected at deployment, this is done using the bool public locked; variable and the bytes32 private password; variable, the problem is that this data is stored on chain, allowing anyone to determine what is being stored. Private data shouldn’t be stored on-chain
Vault | OpenZeppelin’s Ethernaut Level 8 Walk-Through Read More »
Level 7 of Ethernaut is Force, a lesson in self destruction. We are given this contract that contains a cat: Since the contract has no payable fallback functions we can’t send ether to the contract in the traditional ways.But the hints let us know to use another contract to attack, enter selfdestruct() Self Destruct Contracts
Force | OpenZeppelin’s Ethernaut Level 7 Walk-Through Read More »
More and more lending pools are offering flash loans. In this case, a new pool has launched that is offering flash loans of DVT tokens for free.The pool holds 1 million DVT tokens. You have nothing.To pass this challenge, take all tokens out of the pool. If possible, in a single transaction. https://www.damnvulnerabledefi.xyz/challenges/truster/ Free flash
Truster | Damn Vulnerable DeFi #3 Walk-Through Read More »
We are given the following Solidity file that contains two contracts Delegate and Delegation. Get your new instance and open your console. According to the Solidity docs, delegatecall is similar to a call except it passes the original msg.sender and msg.value, rather than the contract making the call: There exists a special variant of a
Delegation | Ethernaut Level 6 Walk-Through Read More »
There’s a pool with 1000 ETH in balance, offering flash loans. It has a fixed fee of 1 ETH.A user has deployed a contract with 10 ETH in balance. It’s capable of interacting with the pool and receiving flash loans of ETH.Take all ETH out of the user’s contract. If possible, in a single transaction.
Naive receiver | Damn Vulnerable DeFi #2 Walk-Through Read More »
There’s a tokenized vault with a million DVT tokens deposited. It’s offering flash loans for free, until the grace period ends. To pass the challenge, make the vault stop offering flash loans. You start with 10 DVT tokens in balance. https://www.damnvulnerabledefi.xyz/challenges/unstoppable/ We are given two smart contracts ReceiverUnstoppable.sol and UnstoppableVault.sol and the unstoppable.challenge.js file to
Unstoppable | Damn Vulnerable DeFi #1 Walk-Through Read More »
Token asks us to hack the basic token contract supplied. We start with 20 tokens and our objective is to get our hands on more. We are given a hint that an odometer might be of help so let’s start by looking it up.An odometer is the mile tracker in your car that the numbers
Token | Ethernaut Level 5 Walk-Through Read More »
Telephone asks us to claim ownership of the contract. Learn the difference between tx.origin and msg.sender. It supplies us with the following source code: The contract seems simple enough, with just one function changeOwner we can see the requirements for claiming ownership: It seems that tx.origin can not (!=) equal the msg.sender. So let’s head
Telephone | Ethernaut Level 4 Walk-Through Read More »
10 consecutive correct guesses on a coin flip? There is a tiny chance we are gonna have to work the system. We are given the source code of the contract, it tracks consecutiveWins and has a flip function that takes in a bool _guess and returns a bool for heads or tails. Let’s take a
Coin Flip | Ethernaut Level 3 Walk-Through Read More »