Damn Vulnerable DeFi Challenge #4 — Side Entrance

Educational wargame (Side Entrance Lender Pool). Public challenge material from Damn Vulnerable DeFi. Solve scripts and PoC omitted.

Theme

A pool holds ETH and offers a flash loan that calls IFlashLoanEtherReceiver.execute on the borrower. Separately, anyone can deposit / withdraw against an internal balances mapping. The loan succeeds if the pool’s ETH balance is restored by the end of the call—regardless of how the ETH returned.

Root-cause concept

• Repayment checked only as “pool ETH back,” not “same economic path.” ETH credited through deposit during the callback still increases the pool balance for the final check
• That deposit also credits the attacker’s balances entry, so a later withdraw can pull the funds out as if they were a normal customer deposit
• Unrestricted public deposit/withdraw plus a naive flash-loan balance check create a confused-deputy style accounting bug

Impact (abstract)

In the lab, the pool’s entire ETH can be taken in a short sequence of flash-loan callback accounting tricks. In production terms: never treat “balance restored” as proof of a safe flash loan when the same contract has alternate credit paths.

Mitigations / lessons

• Track flash-loan debt explicitly; do not rely solely on address(this).balance before/after
• Disallow or specially account deposits during an active flash loan
• Prefer isolated pool designs where lending and retail deposit ledgers cannot cross-credit
• Review OpenZeppelin sendValue / call-based payouts for reentrancy assumptions (guards where needed)

Solve steps and PoC omitted.