Damn Vulnerable DeFi — Challenge #5 The rewarder (high-level)

Educational challenge: a rewarder pool pays reward tokens on a multi-day round schedule to DVT depositors. A separate flash-loan pool offers DVT. Lab goal: claim most of a round’s rewards without starting with DVT.

Vulnerability class / root cause

• Rewards are computed from snapshot balances at distribute time, not from time-weighted deposits across the whole round.
• Deposit and withdraw can happen in the same transaction as a flash loan of the liquidity token.
• An actor can therefore appear as a huge depositor at snapshot/distribution, collect rewards, then return liquidity—snapshot gaming / flash-loan governance-or-reward manipulation as a class.

Impact (abstract)

Honest long-term depositors receive little or no reward share for that round; the attacker extracts most reward-token issuance. Economic fairness failure of the reward program.

Mitigations / lessons

• Use time-weighted or minimum-hold thresholds before a deposit counts toward rewards.
• Disallow reward claims in the same transaction as deposit, or require deposits to persist across a round boundary with meaningful duration.
• Isolate reward liquidity from flash-loanable same-asset pools, or snapshot in a way that cannot be inflated atomically.
• Monitor abnormal deposit/withdraw churn around round boundaries.

Solve steps and PoC omitted.