Damn Vulnerable DeFi Challenge #3 — Truster

Wargame pool that offers free flash loans of DVT while holding a large token balance. Public challenge materials: Damn Vulnerable DeFi. Solve steps and PoC omitted.

Theme

TrusterLenderPool.flashLoan transfers tokens to a borrower, then performs a generic external call (target + data) before checking that the pool balance was restored.

Root-cause concept

• Caller-controlled callback target and calldata executed in the pool’s context during the loan window
• Balance invariance alone does not stop ERC-20 approve-style side effects: allowance can change without reducing the pool’s token balance mid-call
• Flash-loan “free form” callbacks are only safe if the callee and ABI are strictly constrained

Impact (abstract)

A single transaction could arrange approval (or similar) so the pool’s tokens can be pulled afterward — full inventory loss in the lab setting.

Mitigations / lessons

• Do not let untrusted users supply arbitrary target/data for calls made as the pool
• If callbacks are required, whitelist callees and selectors; never approve unlimited allowance to borrower-controlled spenders
• Prefer pull-pattern designs and explicit repayment without generic functionCall
• Review flash-loan code for any state change that is not captured by a simple balance check

Solve steps and PoC omitted.