Damn Vulnerable DeFi Challenge #7 — Compromised

Educational wargame by @tinchoabbate. Contracts live under the public compromised challenge tree. Solve scripts and PoC omitted.

Theme

An on-chain exchange sells overpriced “DVNFT” collectibles. Price comes from a trustful oracle fed by a small fixed set of reporter addresses. The challenge narrative includes strange hex blobs from a related web response that encode material tied to those reporters.

Root-cause concept

• Centralized / low-cardinality oracle trust: a handful of EOAs can push prices that the exchange treats as truth
• Off-chain secret leakage: if reporter private keys appear in HTTP responses, logs, or other non-chain channels, oracle integrity collapses
• Once a majority (or enough) reporters are controlled, posted prices can be moved arbitrarily, and exchange buy/sell flows that trust that price become unsafe

Impact (abstract)

In the lab, a player starting with a tiny ETH balance is expected to drain the exchange’s ETH by abusing corrupted oracle prices. In production terms: leaked oracle-signer keys can enable unfair pricing and loss of exchange funds.

Mitigations / lessons

• Never place oracle signer keys in web responses, client bundles, or world-readable logs
• Prefer decentralized or medianized price feeds with dispute windows; avoid tiny fixed reporter sets without rotation and monitoring
• Bound how far a single price update can move; circuit-breakers on exchange inventory
• Separate “can post price” from “can withdraw exchange ETH”

Solve steps and PoC omitted.