Damn Vulnerable DeFi Challenge #7 — Compromised

High-level notes only. Full decode/solve material from the archive is omitted.

Theme

Challenge story: odd hex content in an HTTP response from a “popular DeFi” web service; an on-chain exchange sells DVNFTs at an absurd oracle price backed by three named reporter addresses. Starting balance is 0.1 ETH; the educational goal is to take the exchange’s ETH.

Root-cause concept

• Oracle security collapses when reporter signing keys leak outside the chain
• A small static reporter set means compromising a majority of sources rewrites “truth” for the exchange
• NFT buy/sell paths that trust that price inherit the oracle failure

Impact (abstract)

Manipulated postings can make collectibles appear cheap or expensive at will, enabling drainage of exchange ETH in the lab.

Mitigations / lessons

• Keep oracle keys in HSMs / dedicated signers; never embed them in HTTP bodies or front-end assets
• Monitor reporter set membership and price deviation
• Add exchange-level circuit breakers and inventory limits

Solve steps and PoC omitted.