The Honest View

1// Quantix Security Research Network — training challenge.2// Intentionally vulnerable. Written for education; do not deploy.3// SPDX-License-Identifier: MIT4pragma solidity 0.8.24;5 6contract EthPool {7    uint256 public totalShares;8    uint256 public reserveEth;9    uint256 public reserveToken;10    mapping(address => uint256) public shares;11    bool private locked;12 13    modifier nonReentrant() {14        require(!locked, "reentrant");15        locked = true;16        _;17        locked = false;18    }19 20    /// Value of one share in ETH terms (1e18 precision).21    function sharePrice() external view returns (uint256) {22        return ((reserveEth * 2) * 1e18) / totalShares; // simplified valuation23    }24 25    function removeLiquidity(uint256 amount) external nonReentrant {26        uint256 ethOut = (reserveEth * amount) / totalShares;27        uint256 tokenOut = (reserveToken * amount) / totalShares;28 29        shares[msg.sender] -= amount;30        totalShares -= amount;31 32        (bool ok, ) = msg.sender.call{value: ethOut}("");33        require(ok, "eth transfer failed");34 35        reserveEth -= ethOut;36        reserveToken -= tokenOut;37        // token transfer omitted for brevity38    }39}

1function collateralValue(address user) public view returns (uint256) {2    return (pool.shares(user) * pool.sharePrice()) / 1e18;3}4 5function borrow(uint256 amount) external {6    require(debt[msg.sender] + amount <= collateralValue(msg.sender) * 70 / 100, "insufficient collateral");7    debt[msg.sender] += amount;8    weth.transfer(msg.sender, amount);9}