First Flight #3: Thunder Loan

Summary

Initializers must be protected

Vulnerability Details

Location: Function ThunderLoanUpgraded.revertIfZero(uint256) (src/upgradedProtocol/ThunderLoanUpgraded.sol#114-119) is an unprotected initializer.

Impact

Upgradability Risks: The contract uses the UUPS (Universal Upgradeable Proxy Standard) pattern for upgradability. If not properly managed, this could lead to risks such as an attacker gaining control of the proxy admin and changing the implementation contract.

Tools Used

Audit Wizard (Slither)

Recommendations

Protect initializers with modifiers/require statements