There's a lending pool offering quite expensive flash loans of Ether, which has 1000 ETH in balance.You also see that a user has deployed a contract with 10 ETH in balance, capable of interacting with the lending pool and receiveing flash loans of ETH.Drain all ETH funds from the user's contract. Doing it in a single transaction is a big plus ;)
The challenge file sets up a lending pool and a user receiver contracts. The receiver contract is configured with the lending pool address so that it could interact with it:
The target of the contract which we need to empty is stored at
this.receiver. It is deployed using
FlashLoanReceiver contract which includes on interesting function capable of reducing user’s wallet:
In the above snippet,
receiveEther accepts an arbitrarily sized fee and sends it to the pool address along with the borrowed amount. Note that the function verifies
msg.sender to match the pool address to make sure that we can’t just call it directly and drain all of the funds. Ok, let’s work with the
LenderPool contract and see if we can trigger
This looks promising!
flashLoan can be called by anyone and calls
receiveEther on the target borrower contract with an arbitrary loan amount. Unfortunately, the fee is hard-coded to just 1 ETH, so we will need to trigger this function as many times as necessary until the borrower account is completely drained due to fees.