First Flight #3: Thunder Loan

Summary

Vulnerability Details

In the "executeOperation" callback when a user calls "flashloan," there is an inconsistency between the "assetToken's total supply" and the "underlying token's balance." This inconsistency occurs because there is no "burn" call before executing "transferUnderlyingTo," as is done in the redeem function.

Impact

Tools Used

Recommendations

It is strongly recommended to add a "burn" call before invoking "transferUnderlyingTo" to ensure consistency between the "assetToken's total supply" and the "underlying token's balance" in the "executeOperation" callback when a user calls "flashloan." This adjustment is essential to address the inconsistency issue effectively.