> For the complete documentation index, see [llms.txt](https://calnix.gitbook.io/eth-dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://calnix.gitbook.io/eth-dev/smart-contract-security/damn-vulnerable-defi/9.-puppet-v2.md).

# 9. Puppet V2

## Objective

* The developers of the [previous pool](https://damnvulnerabledefi.xyz/challenges/puppet/) seem to have learned the lesson. And released a new version!
* Now they’re using a [Uniswap v2 exchange](https://docs.uniswap.org/contracts/v2/overview) as a price oracle, along with the recommended utility libraries. 
* You start with 20 ETH and 10000 DVT tokens in balance. The pool has a million DVT tokens in balance. Drain it.

{% hint style="info" %}
Now collateral require is 3x of the token price
{% endhint %}

## Approach

Pricing is obtained from `UniswapV2Library.quote` 

<figure><img src="/files/4RpIulSLB0CFSsaNbCQR" alt=""><figcaption></figcaption></figure>

```
// For amountA, how much B can I get
amountB = amountA (reserveB / reserveA)

// Explanation
(reserveB / reserveA) = Unit Price of A, in terms of B

// Example
assetA : assetB
10 ETH : 10,000 USDC
 1 ETH : (10,000 USDC/10 ETH) = 1000 USDC
 
 (reserveB / reserveA) = (10,000/10) USDC/ETH = 1000 USDC per ETH
 For 2 ETH,
          2 * (10,000/10) = 2000 USDC (amountB)
```

1. Target pool has 1,000,000 DVT
2. Uniswap Exchange has 100 DVT and 10 ETH -> 10 DVT: 1 ETH

* **Cost for 1 MM DVT = 1 MM \* (10 / 100) = 100,000 ETH**
* **requiredCollateral = 100K ETH \* 3 = 300K ETH**

#### Attacker needs to devalue DVT, by selling DVT into the Uniswap exchange.

* attacker calls `swapExactTokensForTokens()` via uniswap router

<figure><img src="/files/mUuRs8RXdgCOYtkPCOGu" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
<https://docs.uniswap.org/contracts/v2/reference/smart-contracts/router-02#swapexacttokensfortokens>
{% endhint %}

<figure><img src="/files/IQjYWxf9AMjkOeIpGHCZ" alt=""><figcaption></figcaption></figure>

* amountIn = ATTACKER\_INITIAL\_TOKEN\_BALANCE
* amountOutMin = 0  (arbitrary)
* path = An array of token addresses.
  * path is a dynamic array of addresses
* to = attacker address
* deadline = Unix timestamp after which the transaction will revert. (arbitrary)

#### on `path`: dynamic array of addresses

<figure><img src="/files/5lGoyyqwGO6HpUKJV5Oi" alt=""><figcaption></figcaption></figure>

#### Uniswap Exchange

* started: 100 DVT and 10 ETH
* attacker sold 1000 DVT
* ended:

<figure><img src="/files/qPn2bJToCPaB3YxsbPEG" alt=""><figcaption><p>uniswap swap formula</p></figcaption></figure>

<figure><img src="/files/nABApm3rrnxr0nVxoEma" alt=""><figcaption></figcaption></figure>

#### Draining the lending pool

* lending pool has 1 MM dvt token.&#x20;
* Currently valued at 1 MM \*&#x20;

####