First Flight #3: Thunder Loan

Summary

Detection of the reentrancy bug. Only report reentrancy that acts as a double call (see reentrancy-eth, reentrancy-no-eth).

Vulnerability Details

Location:

Reentrancy in ThunderLoan.flashloan(address,IERC20,uint256,bytes) (src/protocol/ThunderLoan.sol#180-217):
External calls:

• assetToken.updateExchangeRate(fee) (src/protocol/ThunderLoan.sol#194)

• assetToken.transferUnderlyingTo(receiverAddress,amount) (src/protocol/ThunderLoan.sol#199)
  -receiverAddress.functionCall(abi.encodeWithSignature(executeOperation(address,uint256,uint256,address,bytes),address(token),amount,fee,msg.sender,params)) (src/protocol/ThunderLoan.sol#201-210)
  State variables written after the call(s):

• s_currentlyFlashLoaning[token] = false (src/protocol/ThunderLoan.sol#216)

Impact

Potential for Front-Running: Public functions like deposit, redeem, and flashloan could be potentially front-run by bots, leading to potential losses for users.

Tools Used

Audit Wizard (Slither)

Recommendations

Apply the check-effects-interactions pattern.