First Flight #3: Thunder Loan

Summary

Governance functions should be controlled by time locks

Vulnerability Details

Governance functions (such as upgrading contracts, setting critical parameters) should be controlled using time locks to introduce a delay between a proposal and its execution. This gives users time to exit before a potentially dangerous or malicious operation is applied.

Lines of code

Total -> 24

(https://github.com/Cyfrin/2023-11-Thunder-Loan/blob/main/./src/protocol/AssetToken.sol#L10), 36, 38, 68, 72, 76, 80, 92, 11, 15, 83, 227, 253, 280, 83, 225, 251, 274, 9, 10, 38, 41, 32

Tools Used

No tools used. It was discovered through manual inspection of the contract.