First Flight #3: Thunder Loan

Summary

Detect missing events for critical arithmetic parameters.

Vulnerability Details

Location: ThunderLoan.updateFlashLoanFee(uint256) (src/protocol/ThunderLoan.sol#253-258) should emit an event for:

• s_flashLoanFee = newFee (src/protocol/ThunderLoan.sol#257)

Impact

No liquidity checks: The contract does not seem to check if there is enough liquidity in the contract to service a flash loan. This could potentially lead to failed transactions.

No checks on newFee in updateFlashLoanFee: Although there is a condition that newFee should not be greater than s_feePrecision, there is no lower limit check. This could potentially allow setting the fee to zero.

Tools Used

Audit Wizard (Slither)

Recommendations

Emit an event for critical parameter changes.