First Flight #3: Thunder Loan

Summary

Reentracy attack allows for multiple flash loans to be taken out by a single attacker, leading to stolen funds.

Vulnerability Details

When ThunderLoan makes the function call [executeOperation()] to the receiver address/contract, to recall the loan, there are no return checks for the success of the call. So an attacker can have fallback function that calls flashloan() recursively, where thunderloan makes successive transfers of the underlying asset to the attacker.

Impact

These successive transfers of the underlying asset to the attack continues until the attacker stops or the thunderloan asset balance has been completely drained.

Tools Used

Recommendations

include a require statement around the functionCall() to check whether the reciever address contract has correctly implemented the executeOperation() function to pay back the loan.