Damn Vulnerable DeFi Challenge #3 — Truster

Blog-era notes on the same educational challenge covered in the Paragraph “Truster” analysis. Provider: @tinchoabbate. Solve steps and PoC omitted.

Theme

A lending pool advertises free flash loans of DVT and holds on the order of a million tokens. The player starts with nothing and is challenged to empty the pool in one transaction.

Root-cause concept

• flashLoan sends tokens, then performs a generic external call with a borrower-chosen target address and calldata
• Repayment is enforced only via “balance before == balance after”
• That check misses ERC-20 allowance changes and similar side effects executed during the callback

Impact (abstract)

Control of the callback can be enough to authorize later withdrawal of the pool’s tokens without leaving the balance check failing mid-loan.

Mitigations / lessons

• Constrain flash-loan callbacks; never forward arbitrary calldata as the pool
• Audit for approve / transferFrom patterns around loan helpers
• Treat “balance unchanged” as necessary but not sufficient for safety

Solve steps and PoC omitted.