The condition that checks the player’s nonce value in the Puppet challenge does not seem appropriate.

[dokpark21]

Calling testPuppet using startPrank(player, player) and then checking whether the player’s nonce is 1 does not seem appropriate.

In the startPrank context, only msg.sender is set to the player—transactions like token transfers or function calls do not increase the nonce. As a result, even if multiple actions are performed (such as deploying an exploit contract and transferring tokens), the player’s nonce only becomes 1 because only the contract deployment counts.

        console.log("Player nonce:", vm.getNonce(player));
        exploit = new AttackPuppetPool{value: PLAYER_INITIAL_ETH_BALANCE}( // increase nonce
            token,
            lendingPool,
            uniswapV1Exchange,
            recovery
        );
        console.log("Player nonce:", vm.getNonce(player));
        token.transfer(address(exploit), PLAYER_INITIAL_TOKEN_BALANCE);
        console.log("Player nonce:", vm.getNonce(player));
        exploit.attack(POOL_INITIAL_TOKEN_BALANCE);
        console.log("Player nonce:", vm.getNonce(player));

However, if you execute each action separately without deploying a contract and just call functions as msg.sender = player, no signed transaction occurs, so the nonce remains 0.

       // not use AttackPuppetPool contract -> but nonce is 0, because in startPrank tx.origin is not player, just msg.sender
        token.approve(address(uniswapV1Exchange), PLAYER_INITIAL_TOKEN_BALANCE);
        uniswapV1Exchange.tokenToEthTransferInput(
            PLAYER_INITIAL_TOKEN_BALANCE,
            9,
            block.timestamp,
            address(player)
        );
        lendingPool.borrow{value: address(player).balance}(
            POOL_INITIAL_TOKEN_BALANCE,
            recovery
        );
        console.log("Player nonce:", vm.getNonce(player));

Therefore, the nonce check condition should either be removed or replaced with a warning that says “you must deploy an attack contract.”

[l4n0r]

Noticed that too, it's actually much more easy with the current checks since there's no need to create a contract
Also this problem is present in other 4 challenges that require a maximum number of transactions
I opened this pull request fixing this, using vm.startBroadcast instead of vm.startPrank