First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Contract not implementing ERC3156Receiver Specification

aballok

Summary

Contracts not following widely used and considered best practises ERC3156Receiver Specification

Vulnerability Details

The contract uses the following specification for the callback from contract receiving loan

interface IFlashLoanReceiver {
function executeOperation(
address token,
uint256 amount,
uint256 fee,
address initiator,
bytes calldata params
)
external
returns (bool);
}

However widely used and supported in DeFi specification is as below

interface IERC3156FlashBorrower {
/**
* @dev Receive a flash loan.
* @param initiator The initiator of the loan.
* @param token The loan currency.
* @param amount The amount of tokens lent.
* @param fee The additional amount of tokens to repay.
* @param data Arbitrary data structure, intended to contain user-defined parameters.
* @return The keccak256 hash of "ERC3156FlashBorrower.onFlashLoan"
*/
function onFlashLoan(
address initiator,
address token,
uint256 amount,
uint256 fee,
bytes calldata data
) external returns (bytes32);
}

The above clearly shows that the function ordering is different or incorrect(relative to the specification)

Impact

This can lead to integration problems with most contracts in DeFi wanting to use one contract e.g for arbitrage, yield, liquidation wanting to use a common specification and this contract will not allow that ude to differences in the interface to be implemented.

This can also lead to errors as even if the specification is implemented when inputting parameters and inputs receiving contracts may input parameters incorrectly in order they understand or considered best practises of IERC3156Receiver.

Additionally it may lead to unexpected behaviours or open up attack paths by implementing interface this way as opposed to common way

Tools Used

Manual Analysis

Recommendations

Recommended the IFlashLoanReceiver.sol implement IERC3156FlashBorrower specification

Updates

Lead Judging Commences

0xnevi Lead Judge
about 2 years ago
0xnevi Lead Judge about 2 years ago
Submission Judgement Published
Invalidated
Reason: EIP compliance with no integrations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.