Damn Vulnerable DeFi - 3

Challenge #3 - Truster

A growing number of lending pools offer flash loans. In this case, a new mining pool has been launched offering flash loans of DVT tokens for free.

The pool holds 1 million DVT tokens. you have nothing.

To pass this challenge, take all tokens out of the pool. In a single transaction if possible.

This question still provides the flashLoan function to borrow money, but there is such a line of code in flashLoan:

We can call the specified method by constructing the data parameter

truster.challenge.js:

We choose to construct data through the web3.eth.abi.encodeFunctionCall() method. Here I choose to download the web3-eth-abi package through yarn add and then import it.

Because it will check whether the balance in the pool is the same before and after the loan , we cannot directly call the transfer function, but we can call the approve function to directly transfer the money in the pool to us after the loan.

For details on how to use the web3.eth.abi.encodeFunctionCall() method, please refer to: https://learnblockchain.cn/docs/web3.js/web3-eth-abi.html#encodefunctioncall

test:

Guess you like

Origin blog.csdn.net/m0_52030813/article/details/129220102