Challenge #7 - CompromisedWhile poking around a web service of one of the most popular DeFi projects in the space, you get a somewhat strange response from their server. This is a snippet: HTTP/2 200 OK content-type: text/html content-language: en vary: Accept-Encoding server: cloudflare 4d 48 68 6a 4e 6a 63 34 5a 57 59 78 59 57 45 30 4e 54 5a 6b 59 54 59 31 59 7a 5a 6d 59 7a 55 34 4e 6a 46 6b 4e 44 51 34 4f 54 4a 6a 5a 47 5a 68 59 7a 42 6a 4e 6d 4d 34 59 7a 49 31 4e 6a 42 69 5a 6a 42 6a 4f 5...

Challenge #7 - CompromisedWhile poking around a web service of one of the most popular DeFi projects in the space, you get a somewhat strange response from their server. This is a snippet: HTTP/2 200 OK content-type: text/html content-language: en vary: Accept-Encoding server: cloudflare 4d 48 68 6a 4e 6a 63 34 5a 57 59 78 59 57 45 30 4e 54 5a 6b 59 54 59 31 59 7a 5a 6d 59 7a 55 34 4e 6a 46 6b 4e 44 51 34 4f 54 4a 6a 5a 47 5a 68 59 7a 42 6a 4e 6d 4d 34 59 7a 49 31 4e 6a 42 69 5a 6a 42 6a 4f 5...

Challenge #6 - SelfieA new cool lending pool has launched! It's now offering flash loans of DVT tokens. Wow, and it even includes a really fancy governance mechanism to control it. What could go wrong, right ? You start with no DVT tokens in balance, and the pool has 1.5 million. Your objective: take them all.See the contractsComplete the challengeOpenZeppelin 文档 ERC20Snapshot.sol 目标: 取走闪电贷池中的150万个DVT token after(async function () { /** SUCCESS CONDITIONS */ // Attacker has taken all tok...

Challenge #6 - SelfieA new cool lending pool has launched! It's now offering flash loans of DVT tokens. Wow, and it even includes a really fancy governance mechanism to control it. What could go wrong, right ? You start with no DVT tokens in balance, and the pool has 1.5 million. Your objective: take them all.See the contractsComplete the challengeOpenZeppelin 文档 ERC20Snapshot.sol 目标: 取走闪电贷池中的150万个DVT token after(async function () { /** SUCCESS CONDITIONS */ // Attacker has taken all tok...

Challenge #5 - The rewarderThere's a pool offering rewards in tokens every 5 days for those who deposit their DVT tokens into it. Alice, Bob, Charlie and David have already deposited some DVT tokens, and have won their rewards! You don't have any DVT tokens. But in the upcoming round, you must claim most rewards for yourself. Oh, by the way, rumours say a new pool has just landed on mainnet. Isn't it offering DVT tokens in flash loans?See the contractsComplete the challengeERC2...

Challenge #5 - The rewarderThere's a pool offering rewards in tokens every 5 days for those who deposit their DVT tokens into it. Alice, Bob, Charlie and David have already deposited some DVT tokens, and have won their rewards! You don't have any DVT tokens. But in the upcoming round, you must claim most rewards for yourself. Oh, by the way, rumours say a new pool has just landed on mainnet. Isn't it offering DVT tokens in flash loans?See the contractsComplete the challengeERC2...

Challenge #9 - Puppet v2The developers of the last lending pool are saying that they've learned the lesson. And just released a new version! Now they're using a Uniswap v2 exchange as a price oracle, along with the recommended utility libraries. That should be enough. You start with 20 ETH and 10000 DVT tokens in balance. The new lending pool has a million DVT tokens in balance. You know what to do ;)See the contractsComplete the challengeUniswapV2 文档UniswapV2Library.sol 目标: 取走借贷池中所...

Challenge #9 - Puppet v2The developers of the last lending pool are saying that they've learned the lesson. And just released a new version! Now they're using a Uniswap v2 exchange as a price oracle, along with the recommended utility libraries. That should be enough. You start with 20 ETH and 10000 DVT tokens in balance. The new lending pool has a million DVT tokens in balance. You know what to do ;)See the contractsComplete the challengeUniswapV2 文档UniswapV2Library.sol 目标: 取走借贷池中所...

Challenge #13 - Safe minersSomebody has sent +2 million DVT tokens to 0x79658d35aB5c38B6b988C23D02e0410A380B8D5c. But the address is empty, isn't it? To pass this challenge, you have to take all tokens out. You may need to use prior knowledge, safely.Complete the challengecreate 文档 目标: 偷走所有DVT token after(async function () { /** SUCCESS CONDITIONS */ // The attacker took all tokens available in the deposit address expect(await this.token.balanceOf(DEPOSIT_ADDRESS)).to.eq("0"); expect(awa...

Challenge #13 - Safe minersSomebody has sent +2 million DVT tokens to 0x79658d35aB5c38B6b988C23D02e0410A380B8D5c. But the address is empty, isn't it? To pass this challenge, you have to take all tokens out. You may need to use prior knowledge, safely.Complete the challengecreate 文档 目标: 偷走所有DVT token after(async function () { /** SUCCESS CONDITIONS */ // The attacker took all tokens available in the deposit address expect(await this.token.balanceOf(DEPOSIT_ADDRESS)).to.eq("0"); expect(awa...

Challenge #2 - Naive receiverThere's a lending pool offering quite expensive flash loans of Ether, which has 1000 ETH in balance. You also see that a user has deployed a contract with 10 ETH in balance, capable of interacting with the lending pool and receiveing flash loans of ETH. Drain all ETH funds from the user's contract. Doing it in a single transaction is a big plus ;)See the contractsComplete the challengeOpenZeppelin文档 目标: 耗尽用户合约中的所有ETH after(async function () { /** SUCCESS...

Challenge #2 - Naive receiverThere's a lending pool offering quite expensive flash loans of Ether, which has 1000 ETH in balance. You also see that a user has deployed a contract with 10 ETH in balance, capable of interacting with the lending pool and receiveing flash loans of ETH. Drain all ETH funds from the user's contract. Doing it in a single transaction is a big plus ;)See the contractsComplete the challengeOpenZeppelin文档 目标: 耗尽用户合约中的所有ETH after(async function () { /** SUCCESS...

Challenge #4 - Side entranceA surprisingly simple lending pool allows anyone to deposit ETH, and withdraw it at any point in time. This very simple lending pool has 1000 ETH in balance already, and is offering free flash loans using the deposited ETH to promote their system. You must take all ETH from the lending pool.目标: 从闪电贷池中取走所有ETH after(async function () { /** SUCCESS CONDITIONS */ expect(await ethers.provider.getBalance(this.pool.address)).to.be.equal("0"); // Not checking exactly how m...

Challenge #4 - Side entranceA surprisingly simple lending pool allows anyone to deposit ETH, and withdraw it at any point in time. This very simple lending pool has 1000 ETH in balance already, and is offering free flash loans using the deposited ETH to promote their system. You must take all ETH from the lending pool.目标: 从闪电贷池中取走所有ETH after(async function () { /** SUCCESS CONDITIONS */ expect(await ethers.provider.getBalance(this.pool.address)).to.be.equal("0"); // Not checking exactly how m...

Challenge #8 - PuppetThere's a huge lending pool borrowing Damn Valuable Tokens (DVTs), where you first need to deposit twice the borrow amount in ETH as collateral. The pool currently has 100000 DVTs in liquidity. There's a DVT market opened in an Uniswap v1 exchange, currently with 10 ETH and 10 DVT in liquidity. Starting with 25 ETH and 1000 DVTs in balance, you must steal all tokens from the lending pool.See the contractsComplete the challengeUniswapV1 文档 目标: 从借贷池中偷走所有token afte...

Challenge #8 - PuppetThere's a huge lending pool borrowing Damn Valuable Tokens (DVTs), where you first need to deposit twice the borrow amount in ETH as collateral. The pool currently has 100000 DVTs in liquidity. There's a DVT market opened in an Uniswap v1 exchange, currently with 10 ETH and 10 DVT in liquidity. Starting with 25 ETH and 1000 DVTs in balance, you must steal all tokens from the lending pool.See the contractsComplete the challengeUniswapV1 文档 目标: 从借贷池中偷走所有token afte...

Challenge #11 - BackdoorTo incentivize the creation of more secure wallets in their team, someone has deployed a registry of Gnosis Safe wallets. When someone in the team deploys and registers a wallet, they will earn 10 DVT tokens. To make sure everything is safe and sound, the registry tightly integrates with the legitimate Gnosis Safe Proxy Factory, and has some additional safety checks. Currently there are four people registered as beneficiaries: Alice, Bob, Charlie and David. The registr...

Challenge #11 - BackdoorTo incentivize the creation of more secure wallets in their team, someone has deployed a registry of Gnosis Safe wallets. When someone in the team deploys and registers a wallet, they will earn 10 DVT tokens. To make sure everything is safe and sound, the registry tightly integrates with the legitimate Gnosis Safe Proxy Factory, and has some additional safety checks. Currently there are four people registered as beneficiaries: Alice, Bob, Charlie and David. The registr...

Challenge #12 - ClimberThere's a secure vault contract guarding 10 million DVT tokens. The vault is upgradeable, following the UUPS pattern. The owner of the vault, currently a timelock contract, can withdraw a very limited amount of tokens every 15 days. On the vault there's an additional role with powers to sweep all tokens in case of an emergency. On the timelock, only an account with a "Proposer" role can schedule actions that can be executed 1 hour later. Your goal is to empty ...

Challenge #12 - ClimberThere's a secure vault contract guarding 10 million DVT tokens. The vault is upgradeable, following the UUPS pattern. The owner of the vault, currently a timelock contract, can withdraw a very limited amount of tokens every 15 days. On the vault there's an additional role with powers to sweep all tokens in case of an emergency. On the timelock, only an account with a "Proposer" role can schedule actions that can be executed 1 hour later. Your goal is to empty ...

Challenge #10 - Free riderA new marketplace of Damn Valuable NFTs has been released! There's been an initial mint of 6 NFTs, which are available for sale in the marketplace. Each one at 15 ETH. A buyer has shared with you a secret alpha: the marketplace is vulnerable and all tokens can be taken. Yet the buyer doesn't know how to do it. So it's offering a payout of 45 ETH for whoever is willing to take the NFTs out and send them their way. You want to build some rep with this bu...

Challenge #10 - Free riderA new marketplace of Damn Valuable NFTs has been released! There's been an initial mint of 6 NFTs, which are available for sale in the marketplace. Each one at 15 ETH. A buyer has shared with you a secret alpha: the marketplace is vulnerable and all tokens can be taken. Yet the buyer doesn't know how to do it. So it's offering a payout of 45 ETH for whoever is willing to take the NFTs out and send them their way. You want to build some rep with this bu...

Challenge #3 - TrusterMore and more lending pools are offering flash loans. In this case, a new pool has launched that is offering flash loans of DVT tokens for free. Currently the pool has 1 million DVT tokens in balance. And you have nothing. But don't worry, you might be able to take them all from the pool. In a single transaction.See the contractsComplete the challengeOpenZeppelin文档 目标: 取走闪电贷池中的100万个DVT token after(async function () { /** SUCCESS CONDITIONS */ // Attacker has taken a...

Challenge #3 - TrusterMore and more lending pools are offering flash loans. In this case, a new pool has launched that is offering flash loans of DVT tokens for free. Currently the pool has 1 million DVT tokens in balance. And you have nothing. But don't worry, you might be able to take them all from the pool. In a single transaction.See the contractsComplete the challengeOpenZeppelin文档 目标: 取走闪电贷池中的100万个DVT token after(async function () { /** SUCCESS CONDITIONS */ // Attacker has taken a...