Damn Vulnerable DeFi

The Puppet challenge involves exploiting a lending pool and a Uniswap v1 exchange to drain assets.

Scenario Details:

• Lending Pool: Users can borrow Damn Valuable Tokens (DVTs) by depositing ETH collateral at a 2:1 ratio (e.g., to borrow 1 DVT, you must deposit 2 ETH). The pool contains 100,000 DVTs in liquidity.
• Uniswap v1 Exchange: A DVT market exists with 10 ETH and 10 DVT in liquidity.
• Starting Balance: 25 ETH and 1,000 DVTs.

Objective: Save all tokens from the lending pool and deposit them into the designated recovery account.

Puppet V3 is a DeFi security challenge where the target lending pool has transitioned from using spot prices to using a Uniswap V3 oracle. The pool now queries the Time-Weighted Average Price (TWAP) of assets using recommended libraries.

Challenge Parameters:

• Uniswap Market Liquidity: 100 WETH and 100 DVT.
• Lending Pool Liquidity: 1,000,000 DVT.
• Starting Balance: 1 ETH and some DVT.
• Objective: Drain all funds from the vulnerable lending pool and send them to the designated recovery account.

Requirement: This challenge requires a valid RPC URL to fork mainnet state into your local environment to simulate the Uniswap V3 oracle environment.

The ABI Smuggling challenge features a permissioned vault containing 1 million DVT tokens. The vault supports two main operations: periodic withdrawals and emergency withdrawals (which allow taking all funds).

Access to these functions is controlled by an embedded generic authorization scheme that restricts specific actions to known, authorized accounts. The objective is to bypass this authorization scheme to rescue all funds from the vault and transfer them to a designated recovery account.

Puppet V2 is a DeFi security challenge where the goal is to exploit a protocol that uses a Uniswap v2 exchange as a price oracle.

Initial State:

• Your balance: 20 ETH and 10000 DVT tokens.
• Pool balance (at risk): 1,000,000 DVT tokens.

Objective: Save all funds from the pool by depositing them into the designated recovery account.

The Climber challenge involves exploiting a secure vault contract containing 10 million DVT tokens. The vault uses the UUPS (Universal Upgradeable Proxy Standard) upgradeable pattern.

Key constraints and components:

• Vault Ownership: Owned by a timelock contract that can withdraw limited tokens every 15 days.
• Emergency Role: The vault has an additional role capable of sweeping all tokens in an emergency.
• Timelock Access: Only accounts with the Proposer role can schedule actions on the timelock, which are then executable after a 1-hour delay.

Goal: Rescue all tokens from the vault and deposit them into the designated recovery account.

Curvy Puppet is a DeFi security challenge involving a lending contract that allows users to borrow LP tokens from Curve's stETH/ETH pool.

Core Mechanics:

• Collateral: Borrowers must deposit Damn Valuable tokens (DVT) as collateral.
• Liquidation: If the borrowed value exceeds the collateral value, any user can liquidate the position by repaying the debt and seizing the collateral.
• Integrations: The contract uses Permit2 for token approvals and a permissioned price oracle for ETH and DVT prices.

Objective: Investigate a bug report claiming positions are not as safe as intended. You must identify the vulnerability, close all positions, and rescue all available collateral before user funds are lost. Any rescued assets must be transferred to the treasury account.

The Rewarder is a DeFi security challenge involving a contract that distributes rewards in Damn Valuable Tokens and WETH.

Goal: Identify and exploit a critical vulnerability in the reward distribution contract to save as many funds as possible. All recovered assets must be transferred to the designated recovery account.

Key Features:

• Distributes multiple token types (Damn Valuable Tokens and WETH).
• Uses a mechanism where users must prove they are part of a chosen set of beneficiaries to claim rewards.
• Optimized for gas, allowing multiple token claims within a single transaction.

The Unstoppable challenge involves a tokenized vault containing 1,000,000 DVT tokens. The vault currently offers free flash loans, but this feature is subject to a grace period. The goal is to exploit a vulnerability to halt the vault, effectively stopping it from offering flash loans.

Objective: Starting with a balance of 10 DVT tokens, demonstrate that it is possible to halt the vault's flash loan functionality.

Free Rider is a DeFi security challenge involving a marketplace of 'Damn Valuable NFTs'.

Scenario Details:

• Target: 6 NFTs initially minted and available for sale at 15 ETH each.
• Vulnerability: A reported critical vulnerability allows all tokens to be taken.
• Objective: Successfully take the NFTs out of the marketplace and send them to the bounty recipient.
• Bounty: 45 ETH for successful recovery.
• Constraint: The recovery process is managed by a dedicated smart contract, and the attacker starts with a very low balance (0.1 ETH), necessitating a way to obtain 'free ETH' temporarily to execute the exploit.

The Wallet Mining challenge involves a contract that rewards users with 1 DVT for deploying Safe wallets. The system uses an upgradeable authorization mechanism where only specific deployers (known as 'wards') are permitted to receive payments for specific deployments.

The Scenario:

• A user at 0xCe07CF30B540Bb84ceC5dA5547e1cb4722F9E496 is intended to receive 20 million DVT tokens in a 1-of-1 Safe wallet.
• The deployment nonce for this Safe was lost.
• There are rumors of a vulnerability in the deployment/authorization system.
• You have access to the user's private key.

Your Objective: In a single transaction, you must:

1. Recover all tokens from the wallet deployer contract and send them to the corresponding ward.
2. Save and return all of the user's funds.

The Naive Receiver challenge involves a pool containing 1000 WETH that offers flash loans with a fixed fee of 1 WETH. The pool integrates with a permissionless forwarder contract to support meta-transactions.

A user has deployed a sample contract containing 10 WETH that is capable of executing WETH flash loans.

Objective: Rescue all WETH from both the user's contract and the flash loan pool, then deposit the total amount into the designated recovery account.

The Withdrawal challenge involves a token bridge used to move Damn Valuable Tokens (DVT) from an L2 to an L1. The L1 side of the bridge allows anyone to finalize withdrawals once a delay period has passed, provided they present a valid Merkle proof corresponding to the latest withdrawals' root set by the bridge owner.

Challenge Objective: As a bridge operator, you must protect the bridge by finalizing all provided withdrawals while preventing a specific 'suspicious' withdrawal from executing and ensuring the bridge's funds are not drained.