Damn Vulnerable DeFi Challenge #8 — Puppet

Educational wargame by @tinchoabbate. Public contracts live under the puppet challenge tree. Solve scripts and PoC omitted.

Theme

PuppetPool lends Damn Valuable Tokens but requires depositing ETH collateral at a multiple of the borrow’s value. The “price” is read from a small Uniswap V1 ETH/DVT exchange (spot reserves), not from a hardened oracle. The player starts with modest ETH and DVT; the pool holds a large DVT inventory.

Root-cause concept

• Spot AMM reserves as a price oracle: x * y = k markets move sharply when liquidity is thin
• A trader who unbalances the pair can make DVT look very cheap in ETH terms for a moment
• The lending pool trusts that momentary quote to size collateral, so under-collateralized borrows become possible relative to the true economic value
• Same-block (or same-transaction) trading plus borrowing is the classic “oracle manipulation” teaching pattern

Impact (abstract)

In the lab, the player can drain the pool’s DVT after distorting the Uniswap V1 quote. In production terms: never size loans from a low-liquidity spot pair you also let borrowers trade against.

Mitigations / lessons

• Use TWAP / medianized / external hardened feeds; avoid raw reserves for risk parameters
• Add liquidity depth requirements, deviation circuit-breakers, and borrow caps
• Separate oracle update permissions from borrower roles
• Assume flash liquidity and same-block trades when threat-modeling DeFi pricing

Solve steps and PoC omitted.