[CurvyPuppet] Hint

[Schereo]

Am I right in the assumption that this is the exploit that should be used in the challenge? https://www.chainsecurity.com/blog/curve-lp-oracle-manipulation-post-mortem

[Schereo]

As far as I understood the exploit is based on the fact that during the reentrance, the total supply of LP tokens is already decreased but the value of the pool is not. Because the calculation of the virtual_price is: value of the pool / LP token supply, the virtual price will increase due to this inconsistency during reentrancy. I checked by adding liquidity in a balanced way (50% ETH, 50% stETH) I receive 1.8e20 LP token which is only ~0.003% of the total supply of LP tokens. Thus burning my LP tokens in the remove_liquidity function doesn't really cause a major inconsistency and liquidation is not possible. Any hint what I'm doing wrong?

[tinchoabbate]

I think you're on the right track. I'd suggest exploring flash loan options! Remember the challenge is forking mainnet, so you've got many options at hand.