Damn Vulnerable DeFi — Challenge #2 Naive Receiver (high-level)

What this is

Wargame notes for Damn Vulnerable DeFi Naive receiver: a lending pool offers ETH flash loans with a fixed fee (1 ETH). A separate user-deployed receiver contract holds ETH and can accept those loans. The challenge theme is draining the receiver.

Wargame provider: @tinchoabbate.

Vulnerability class (concept)

• Caller-chosen borrower: flashLoan(address borrower, …) lets anyone designate which contract pays the fee and runs the receive hook.
• The receiver cannot refuse unsolicited flash loans that still debit its balance via the fixed fee.
• Repeated unsolicited loans therefore act as a griefing / drainage pump against any contract that blindly repays.

Impact (abstract)

A third party can force fee payments until the victim receiver’s ETH is gone, without needing the victim’s private key—only a pool that trusts the caller to name the borrower.

Lessons / what to check

• Flash-loan entrypoints should tie the borrower to msg.sender, or require an explicit pull/opt-in from the receiver.
• Receivers must reject unexpected callbacks and validate initiator / amount / fee.
• Fixed fees amplify damage when loans can be spammed in one transaction.
• Review OpenZeppelin Address/ReentrancyGuard usage: reentrancy safety ≠ economic safety.

Solve steps and PoC omitted.