Damn Vulnerable DeFi — Challenge #11 Backdoor (high-level)

What this is

Study notes for Damn Vulnerable DeFi Backdoor (v2.x): a WalletRegistry that pays DVT to newly registered Gnosis Safe wallets created through the legitimate proxy factory. Four beneficiaries are listed; the wargame goal is to empty the registry’s token balance in one transaction.

Public contracts: backdoor.

Vulnerability class (concept)

• Trusted factory + callback assumptions: the registry treats proxy creation callbacks as proof that a “real” Safe was set up for an approved beneficiary, without fully constraining what the initializer did during setup.
• Powerful Safe setup options: Gnosis Safe initialization can install modules / fallback handlers / delegatecall targets. Those knobs are legitimate for wallets but dangerous if a registry mints value based only on “a proxy appeared for beneficiary X.”
• Token handling via wallet extension points (e.g., fallback manager) so value can move without a first-class transfer on the Safe itself.

Impact (abstract)

A flawed registry integration can let an attacker cause wallets to be registered (and rewarded) under conditions the designer did not intend, draining incentive balances meant only for real team wallets.

Lessons / what to check

• When paying out on proxyCreated (or similar) callbacks, verify owners, threshold, modules, and fallback handler against an allowlist—not just beneficiary address.
• Avoid optional delegatecall during setup for any path that triggers value transfer.
• Prefer pull-based claims with off-chain attestation or governance approval over automatic on-create bounties.
• Review Safe setup and fallback-manager semantics before integrating registries.

Solve steps and PoC omitted.