First Flight #3: Thunder Loan

Summary

Vulnerability Details

The functions "deposit," "redeem," "flashloan," and "repay" lack a reentrancy modifier. While I did not discover additional methods to exploit this issue apart from the oracle price manipulation mentioned in my findings item 11, it appears that these functions should also include the "nonReentrant" modifier.

Impact

Tools Used

Recommendations

Suggest implementing a consistent approach by utilizing the same lock for the "deposit," "redeem," "flashloan," and "repay" functions. This will help safeguard against reentrancy issues and ensure a more uniform and secure design across these functions.