Damn Vulnerable DeFi — Challenge #6 Selfie (high-level)

What this is

Wargame notes for Damn Vulnerable DeFi Selfie: a lending pool offers DVT flash loans and is controlled by a simple governance module. The pool holds a large DVT balance; the player starts with none. Privileged actions (including draining funds) are gated by governance.

Public contracts: selfie.

Vulnerability class (concept)

• Flash-loaned voting power: governance reads a token snapshot that can include balance held only for the duration of a flash loan.
• Queue-then-execute governance with a delay still fails if the proposal threshold was already satisfied under borrowed weight.
• Pool admin functions (onlyGovernance) become reachable once a malicious action is queued and later executed.

Impact (abstract)

Temporary capital can be mistaken for lasting control, allowing an attacker to schedule and later run privileged operations that empty the pool.

Lessons / what to check

• Governance snapshots must exclude flash-loaned balances (checkpoint before loan, time-weighted votes, or non-flashable vote-escrowed tokens).
• Critical vault powers should need multi-step, bonded, or timelocked control with revocation paths—not a single snapshot threshold.
• Treat “flash loan + governance token” as a standard threat model in reviews.

Solve steps and PoC omitted.