Hollow Reserve

The brief

A fictional state's central bank holds its entire reserve in an on-chain vault. An authorised credit facility can borrow from the vault against collateral, with loans priced using the bank's on-chain market. Drain the reserve until the vault holds less than 10% of its initial balance.

In short

Hollow Reserve lends against collateral priced at the spot price of one thin pool. The Offensive Lab flash borrowed 2,000,000 RSV, pushed that price from 100 to about 43,974 and borrowed the whole 10,000,000 RSV vault in a single transaction.

A bank, a lender and one price

The vault holds 10,000,000 RSV. A credit facility lends up to 75 percent of collateral value and asks an oracle for the price. There was no source code, so the lab mapped every contract and function from the bytecode on chain.

The price comes from a thin pool

The oracle reads the spot price of a pool holding 100,000 RSV and 1,000 COL, so one COL counts as 100 RSV. A pool a hundred times deeper sits on the same chain, and the oracle never looks at it.

5 million RSV, free for one transaction

A flash lender holds 5,000,000 RSV and charges no fee, as long as the loan comes back in the same transaction. That is 50 times the RSV in the thin pool, enough to set its price.

One swap, a price 440 times higher

The lab sized the loan against the pool formula. Swapping 2,000,000 RSV in returns 952.245 COL and leaves 47.755 behind. The spot price jumps from 100 to about 43,974 RSV per COL.

The whole vault in one transaction

At that price 952 COL backs 31.4 million RSV of credit, three times the vault. One contract, written straight in bytecode, borrowed all 10,000,000, repaid the loan and left the player 8,001,000. The vault ended at zero.

The insight

A lender that reads the spot price of one thin pool lets anyone with a flash loan set the value of their own collateral.

The flag

hiCTF{th1n_p00l_was_the_r3al_0racle}