First Flight #3: Thunder Loan

Summary

getCalculatedFee() can return a fee with a rounding error.

Vulnerability Details

Do division before multiplication which can result in a rounding error.
(((amount*price) / feeprecision) * loanfee) / feeprecision -> this is a mult, divide, mult, divide

Impact

can result in the fee being lower than its true value. This fee is then passed to updateExchangeRate() to calculate the newExchangeRate. In rare cases this newExchange rate may be now smaller than or equal to the existing exchange rate, causing a revert in the subsequent check -> can impact the protocols ability to do flash loans.

No funds at risk so marked as low risk severity.

Tools Used

Recommendations

when calculating the fee, do all multiply operations before any divisions by feeprecision.