> For the complete documentation index, see [llms.txt](https://calnix.gitbook.io/eth-dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://calnix.gitbook.io/eth-dev/smart-contract-security/damn-vulnerable-defi/4.-side-entrance.md). # 4. Side Entrance https\://www\.damnvulnerabledefi.xyz/challenges/side-entrance/ **Objective** * A surprisingly simple pool allows anyone to deposit ETH, and withdraw it at any point in time. * It has 1000 ETH in balance already, and is offering free flash loans using the deposited ETH to promote their system. * Starting with 1 ETH in balance, pass the challenge by taking all ETH from the pool. **Approach**

* flashLoan function checks the ETH balance of the contract via `address(this).balance;` * however, the balances could be accorded to different addresses as per the mapping `balances` * This means that ownership of the balances, as per `balances` is not taken into account. * This can be achieved by nested a call to `deposit()` within the external `execute()` call **Solution** Since the lendingPool contract calls `.execute` we need to create an attacker contract with such a function. The flash loan will be initiated from such a contract.

* flashLoan is initiated with `attack()` * within the flash loan, execute is called on the caller contract (Attacker) * execute calls deposit -> this updates the balances mapping, incorrectly reflecting that the attacker has ETH balances of the flash loan amount * On returning the flashloan, the balances mapping remains incorrectly updated. * Attacker is able to withdraw ETH that did not originally belong to him, draining the contract * the fallback function is required to collect the ETH balances on withdrawal * without the fallback function, the sending of ether would **revert** {% hint style="info" %} The tests in the foundry version checks that the attacker's wallet have received the ETH. Therefore we need to modify the attack contract to push out the ether recieved to msg.sender. Like so: {% endhint %}

So we will add a call to transfer ether to msg.sender("attacker") within the attack() fn in Attacker Contract:

Please note that this is unsafe for production use as anyone can then call attack as it is an unguarded external function. Proper process would dictate usinga onlyOwner modifier at least.