Damn Vulnerable DeFi — Challenge #9 Puppet v2 (high-level)

Educational follow-on to Puppet: a lending pool prices collateral using Uniswap v2 reserves via official helper libraries. Lab setup gives the player ETH + DVT against a pool holding a large DVT inventory.

Vulnerability class / root cause

• Collateral / deposit requirements are derived from spot reserves in a thin AMM pool (getReserves + quote helpers).
• Spot reserves on a low-liquidity pair can be moved within a single transaction (market manipulation class).
• Even with Uniswap v2 utility libraries, using an immediately manipulable on-chain spot price as a security-critical oracle remains unsafe—the library does not add TWAP or external freshness by itself.

Impact (abstract)

Borrowers can underpay required collateral in oracle terms and extract the lending pool’s token inventory. Classic oracle manipulation leading to protocol insolvency for that market.

Mitigations / lessons

• Prefer TWAPs, multiple venues, or external oracles with deviation checks—not single-block spot reserves on a pool the borrower can trade against.
• Enforce liquidity / manipulation-cost bounds; pause borrowing if reserves move abnormally.
• Separate price-oracle pools from pools traders routinely dump into for the same asset.
• Threat-model any borrow path whose required deposit shrinks when the quoted price moves.

Solve steps and PoC omitted.