First Flight #3: Thunder Loan

Summary

A depositor can lose their tokens if that token is 'unallowed'

Vulnerability Details

Consider this example:

• Protocol 'owner' calls setAllowedToken() for an ERC20 token we'll call 'SomeToken'

• an arbitrary user deposits 1000 tokens of 'SomeToken'

• Protocol 'owner' decides (or accidentally) calls setAllowedToken() again for 'SomeToken' but this time sets the 'allowed' bool value to 'false'

• Whether it was borrowed against or not our user can no longer call redeem() to get their tokens back

Impact

Medium - Low risk of contract owner to do this but if they do then users can have a LOT of money frozen potentially indefinitely

Tools Used

Manual inspection

Recommendations

Many solutions depending on developer's preference but the most obvious is to remove the revertIfNotAllowedToken() modifier from the redeem() function.