Damn Vulnerable DeFi Challenge #6 — Selfie

Educational wargame by @tinchoabbate. Public contracts live under the selfie challenge tree. Solve scripts and PoC omitted.

Theme

SelfiePool offers flash loans of an ERC20 snapshot token. A paired SimpleGovernance module can queue and later execute arbitrary calls (including draining the pool) if the proposer holds enough voting power—defined as more than half of token supply at snapshot time—and waits out a fixed delay (on the order of two days in the lab).

Root-cause concept

• Governance power tied to a momentarily borrowed balance: flash-loan receivers can hold a huge snapshot balance during the callback, enough to pass _hasEnoughVotes
• Queued actions remain valid after the loan is repaid; only time delay stands between proposal and privileged drainAllFunds-style execution
• Pool drain is intentionally gated by onlyGovernance, so compromising governance is equivalent to compromising the treasury

Impact (abstract)

In the lab, a player with zero starting tokens can empty the pool after the governance delay. In production terms: flash-loanable governance tokens (or any momentarily inflated voting power) can capture admin actions if proposals do not require locked / non-borrowed stake.

Mitigations / lessons

• Do not count flash-loanable balances as governance votes; require time-locked deposits, vote escrow, or checkpoints taken before the loan window
• Separate treasury admin from token-weighted proposals, or add multi-sig / timelock with guardians
• Bound what governance may call (target allowlists, calldata restrictions)
• Monitor sudden majority proposals right after large flash activity

Solve steps and PoC omitted.