First Flight #3: Thunder Loan

Summary

Initializers must be protected

Vulnerability Details

Location Number 1: Function AssetToken.revertIfZeroAddress(address) (src/protocol/AssetToken.sol#43-48) is an unprotected initializer.

Location Number 2: Function AssetToken.onlyThunderLoan() (src/protocol/AssetToken.sol#36-41) is an unprotected initializer.

Location Number 3: Function ThunderLoan.revertIfZero(uint256) (src/protocol/ThunderLoan.sol#114-119) is an unprotected initializer.

Impact

No Input Validation: The mint, burn, and transferUnderlyingTo functions do not validate the amount parameter. This could lead to unexpected behavior if the amount is zero or extremely large.

Tools Used

Audit Wizard (Slither)

Recommendations

Protect initializers with modifiers/require statements