Damn Vulnerable DeFi — Challenge #5 The Rewarder (high-level)

What this is

Notes on Damn Vulnerable DeFi The Rewarder: a pool that distributes reward tokens on a multi-day schedule to DVT depositors (Alice, Bob, Charlie, David already participated). A companion flash-loan pool can lend the liquidity token.

Public contracts: the-rewarder.

Vulnerability class (concept)

• Reward snapshot vs. economic reality: accounting takes a balance snapshot when rewards are distributed, without requiring that deposits represent long-lived stake across the reward epoch.
• Flash liquidity as fake TVL: a same-transaction (or same-epoch) deposit funded by a flash loan can dominate the snapshot, claim rewards, then return funds.
• Missing time-weighted or minimum-stake-duration checks on reward eligibility.

Impact (abstract)

Honest long-term depositors can be diluted; emission tokens meant for real liquidity providers can be skimmed by whoever can borrow and deposit for the snapshot moment.

Lessons / what to check

• Tie rewards to time-weighted balances, checkpoints from prior epochs, or cooldowns before eligibility.
• Disallow deposits that are immediately withdrawable from counting at full weight; consider flash-loan-aware guards.
• Separate liquidity mining accounting from raw ERC-20 balanceOf at a single timestamp.
• Audit interactions between flash-loan pools and any contract that mints value from instantaneous balances.

Solve steps and PoC omitted.