Damn Vulnerable DeFi Challenges 17 Curvy Puppet Walkthrough: In my opinion, this was the most difficult challenge. It took me about four days to work through. Unfortunately, AI can’t really help …

CoinsBench's platform is  dedicated to providing insights and analysis on cryptocurrency markets, blockchain technology, and digital assets. Through articles, market reports, and expert analysis, CoinsBench offers insights into cryptocurrency trends, trading strategies, and investment opportunities. Readers can learn about blockchain projects, decentralized finance (DeFi), and cryptocurrency regulations to make informed decisions in the crypto market.

Coins Bench

A detailed walkthrough of the Damn Vulnerable DeFi challenge 'Curvy Puppet', described as the hardest in the series. The exploit combines read-only reentrancy in Curve's remove_liquidity function with flash loans to manipulate LP token pricing. By borrowing ~173,429 stETH from AaveV2 and ~37,991 WETH from Balancer (fee-free), the attacker deposits into the Curve pool to create imbalance, then triggers reentrancy during liquidity removal to artificially depress the LP token virtual price by 3.26×, enabling liquidation of an otherwise healthy position. The walkthrough covers the math behind required flash loan sizing, asset ratios, and the mechanics of Curve's invariant calculation.