First Flight #3: Thunder Loan

Summary

The current flash loan is not updated if the flashloan function reverts.

Vulnerability Details

The s_currentlyFlashLoaning[token] = false; line is not working if the flashloan function reverts and as a result of that the s_currentlyFlashLoaning[token] will remain at true. Exploiting this vulnerability, an attacker can benefit from the system.

Impact

Because of the vulnerability we can pass the condition if (!s_currentlyFlashLoaning[token]) and call the repay function without any limitations. As a result of that the token amount will decrease and because of that the price of the token will increase. Also due to changes in supplyAmount, the mintAmount will decrease and at the end,those who have tokens in their hands will earn massively.

Tools Used

Manual reading.

Recommendations

Before reverting the error in flashloan function, change s_currentlyFlashLoaning back to false.