// AUDIT REPORT
Damn Vulnerable DeFi
Independent security reviews of the Damn Vulnerable DeFi v4 challenge set. Each challenge below is treated as a real protocol audit. I review every challenge by hand with Foundry, Slither, and Aderyn, and each one ships with a full report and a working proof of concept.
// CHALLENGE REPORTS
01 · Unstoppable
A direct token transfer breaks the ERC4626 invariant and permanently disables the vault's flash loans.
02 · Naive Receiver
A spoofable _msgSender() with multicall, plus forced flash loans, lets an attacker drain the receiver and the fee pool.
03 · Truster
An arbitrary call inside flashLoan lets anyone make the pool approve an attacker, then drain its entire token balance in one transaction.
04 · Side Entrance
A flash loan that only checks its raw ETH balance lets the borrower repay via deposit(), minting a withdrawable credit and draining the pool.
05 · The Rewarder
A reward distributor records claims too late, so a user can repeat one valid claim many times and drain both token pools.
06 · Selfie
A free flash loan of the governance token grants a one-transaction vote majority, letting anyone queue and run the pool's emergencyExit() and drain it.
07 · Compromised
Two leaked keys control the median of a three-source oracle, so the price is dropped to buy an NFT cheap and pumped to sell it back for a huge profit.
08 · Puppet
A spot price from one tiny Uniswap v1 market is crashed by dumping DVT, so the borrow deposit shrinks and the player drains the whole pool.
09 · Puppet V2
The pool moved to a Uniswap v2 pair but still reads a spot price, so dumping DVT crashes it and shrinks the WETH deposit enough to drain the whole pool.
10 · Free Rider
A per-NFT payment check and paying the buyer instead of the seller let a flash-swap player take all six NFTs for free and claim the bounty.
11 · Backdoor
The registry only checks the Safe.setup selector, so a hidden delegatecall in setup makes each new wallet approve the attacker, draining all 40 DVT in one transaction.