Damn Vulnerable DeFi Challenge #9 — Puppet v2

Educational follow-up to the original Puppet lending-pool challenge on Damn Vulnerable DeFi. The developers “learned the lesson” and switched the price source to a Uniswap v2 pair plus official helper libraries. Solve steps and PoC omitted.

Theme

A PuppetV2Pool holds a large DVT balance. Borrowing requires a WETH deposit sized from an on-chain quote against a thin DVT/WETH Uniswap v2 pool. The player starts with modest ETH and DVT relative to the pool’s inventory.

Root-cause concept

• Using a manipulable spot AMM reserve ratio as a lending oracle
• Even with Uniswap’s recommended libraries, a low-liquidity pair can be moved in the same transaction (or atomic bundle) before the pool reads “fair” collateral
• Collateral math that trusts that quote inherits the AMM’s short-term price risk

Impact (abstract)

An adversary who can skew the pair’s reported price can under-collateralize a borrow and drain the lending pool’s tokens — classic oracle–manipulation class risk in DeFi education labs.

Mitigations / lessons

• Do not use single-block spot reserves as the sole risk parameter for loans
• Prefer TWAP / multi-block observations, deeper liquidity, or external hardened oracles
• Add borrow caps, deviation checks, and pause switches
• Threat-model atomic swap-then-borrow patterns explicitly in reviews

Solve steps and PoC omitted.