First Flight #3: Thunder Loan

Summary

Vulnerability Details

Location: Reentrancy in ThunderLoan.flashloan(address,IERC20,uint256,bytes) (src/protocol/ThunderLoan.sol#180-217):
External calls:

• assetToken.updateExchangeRate(fee) (src/protocol/ThunderLoan.sol#194)
  Event emitted after the call(s):

• FlashLoan(receiverAddress,token,amount,fee,params) (src/protocol/ThunderLoan.sol#196)

Impact

The contract uses the functionCall method which can potentially lead to reentrancy attacks. However, the contract has a state variable s_currentlyFlashLoaning that prevents reentrancy in the flashloan function.

Tools Used

Audit Wizard (Slither)

Recommendations

Apply the check-effects-interactions pattern.