Damn Vulnerable DeFi — Challenge #8 Puppet (high-level)

What this is

Notes on Damn Vulnerable DeFi Puppet: a lending pool that borrows DVT against ETH collateral priced from a Uniswap v1 DVT/ETH pair. The pool holds a large DVT inventory; the spot market starts very thin. The player begins with modest ETH and DVT.

Public contracts: puppet.

Vulnerability class (concept)

• Spot-price oracle on a low-liquidity AMM: _computeOraclePrice() (and deposit math that keys off it) treats the Uniswap v1 reserve ratio as fair value.
• Collateral requirement tied to that price (here, on the order of 2× the borrowed value in ETH), so distorting the pair can shrink the ETH needed to borrow the pool’s inventory.
• Classic oracle manipulation / market-depth failure mode—not a novel bytecode bug, but a design trust in instantaneous pool ratios.

Impact (abstract)

If collateral and borrow limits follow a manipulable spot price, an attacker with enough market impact can under-collateralize borrows and drain pool tokens. In production, that is direct loss of lending TVL.

Lessons / what to check

• Do not use a single shallow pool’s spot price as a lending oracle.
• Prefer TWAP / multiple venues / conservative price bounds, and circuit breakers on sudden moves.
• Stress-test deposit-required formulas when reserves approach extreme ratios.
• Separate “trading price” from “risk price” used for collateral.

Solve steps and PoC omitted.