// AUDIT REPORT
Damn Vulnerable DeFi
Independent security reviews of the Damn Vulnerable DeFi v4 challenge set. Each challenge below is treated as a real protocol audit. I review every challenge by hand with Foundry, Slither, and Aderyn, and each one ships with a full report and a working proof of concept.
// CHALLENGE REPORTS
01 · Unstoppable
A direct token transfer breaks the ERC4626 invariant and permanently disables the vault's flash loans.
02 · Naive Receiver
A spoofable _msgSender() with multicall, plus forced flash loans, lets an attacker drain the receiver and the fee pool.
03 · Truster
An arbitrary call inside flashLoan lets anyone make the pool approve an attacker, then drain its entire token balance in one transaction.
04 · Side Entrance
A flash loan that only checks its raw ETH balance lets the borrower repay via deposit(), minting a withdrawable credit and draining the pool.
05 · The Rewarder
A reward distributor records claims too late, so a user can repeat one valid claim many times and drain both token pools.
06 · Selfie
A free flash loan of the governance token grants a one-transaction vote majority, letting anyone queue and run the pool's emergencyExit() and drain it.
07 · Compromised
Two leaked keys control the median of a three-source oracle, so the price is dropped to buy an NFT cheap and pumped to sell it back for a huge profit.
08 · Puppet
A spot price from one tiny Uniswap v1 market is crashed by dumping DVT, so the borrow deposit shrinks and the player drains the whole pool.
09 · Puppet V2
The pool moved to a Uniswap v2 pair but still reads a spot price, so dumping DVT crashes it and shrinks the WETH deposit enough to drain the whole pool.
10 · Free Rider
A per-NFT payment check and paying the buyer instead of the seller let a flash-swap player take all six NFTs for free and claim the bounty.
11 · Backdoor
Only the Safe.setup selector is checked, so a hidden delegatecall in setup makes each new wallet approve the attacker and drain all 40 DVT.
12 · Climber
execute runs its batch before checking it was scheduled, so anyone can self-authorize an upgrade of the vault and drain all 10 million DVT.
13 · Wallet Mining
The proxy keeps upgrader in slot 0, the same slot the logic uses for needsInit, so every deployment leaves init open to anyone.
14 · Puppet V3
The 10 minute TWAP reads a tiny Uniswap v3 pool, so 110 DVT crashes the price and drains all 1,000,000 DVT in 114 seconds.
15 · ABI Smuggling
A fixed calldata spot decides the selector check, so a caller chosen offset smuggles sweepFunds past it and drains all 1,000,000 DVT in one call.
16 · Shards
The buy price rounds to zero and the refund uses a far bigger formula, so a player with no DVT drains the marketplace in one transaction.
17 · Curvy Puppet
A read only reentrancy inflates the Curve pool's virtual price, so an attacker liquidates three healthy borrowers in one transaction.
18 · Withdrawal
The signed root hides a 999,000 DVT withdrawal and operators need no proof, so the bad leaf is defused by making its payout revert.