Damn Vulnerable DeFi — Challenge #2 Walkthrough
2 min readNov 18, 2020
Continuing our exploration of the Damn Vulnerable DeFi wargame, the next puzzle is called Naive receiver. It challenges players to drain a DeFi user’s account:
There's a lending pool offering quite expensive flash loans of Ether, which has 1000 ETH in balance.You also see that a user has deployed a contract with 10 ETH in balance, capable of interacting with the lending pool and receiveing flash loans of ETH.Drain all ETH funds from the user's contract. Doing it in a single transaction is a big plus ;)
The challenge file sets up a lending pool and a user receiver contracts. The receiver contract is configured with the lending pool address so that it could interact with it:
The target of the contract which we need to empty is stored at this.receiver. It is deployed using FlashLoanReceiver contract which includes on interesting function capable of reducing user’s wallet:
