[Blackbox] Web3_Staking

Platform: caplag | Category: Blockchain | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-02-22 | Status: Solved Techniques: fee_on_transfer_ledger_drift, evm_bytecode_reverse_engineering, defi_accounting_exploit, pool_drain

Summary

A mini DeFi protocol stack (Bridge, VIP, Staking, Lending, Governance) is deployed on a local Anvil (Foundry) blockchain. The task is to find and exploit a vulnerability in the Staking component. The CLG token has a hidden 10% fee-on-transfer, and the StakingPool records requested amounts instead of

[Blackbox] Web3_Staking — CapLag CTF

Description

A mini DeFi protocol stack (Bridge, VIP, Staking, Lending, Governance) is deployed on a local Anvil (Foundry) blockchain. The task is to find and exploit a vulnerability in the Staking component. The CLG token has a hidden 10% fee-on-transfer, and the StakingPool records requested amounts instead of actual received amounts, creating a ledger drift exploitable to drain the pool.

Analysis

CapLagToken (CLG) is a deflationary ERC20 with 10% burn on every transfer. StakingPool.deposit() records the full requested amount in balances[], but due to the fee, only receives 90%. This drift allows withdrawing the pool's actual balance (which is less than the recorded balance), draining it to zero and triggering the win condition. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
# 1. faucet(1000e18) — get CLG tokens
# 2. approve(pool, MAX) — allow spending
# 3. deposit(1000e18) — pool records 1000, receives 900 (10% fee)
# 4. withdraw(900e18) — drain pool to 0 → isSolved = true → FLAG

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍