First Flight #3: Thunder Loan

Summary

This protocol is upgradable, means all the functions can be completely changed by an bad owner leading lose of funds to all the liquidity provider.

Vulnerability Details

Even if the owner completely don't rug pull but still this is bad for protocol reputation, and if owner is bad, can change fee of the protocol like if he increase the flashloan fee too high then user will not come for flashloan, hence it will cause funds to sit ideal, not doing anything to gain interests.

Note: Marking this medium because owner needs to be bad.

Impact

LP can lose some funds or in some case completely.

Tools Used

Manual review

Recommendations

Use DAO to approve/change any thing in the protocol.