First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Exchange rate logic leads to bad debt/loss of funds

0xJimbo

Summary

Current logic can lead to loss of user funds.

Vulnerability Details

After each deposit, the exchange rate is recalculated. The Exchange rate always increases, but on a deposit the user is minted a number of tokens based on the old exchange rate.

Impact

If a user deposits and then immediately withdraws, they will receive more underlying tokens than they deposited. If there are no flash loans or fees generated, this will leave previous users in a position where the contract does not have enough underlying tokens to make them whole on the amount deposited. The console logs will show a profit is realised for user 2.

If you add the following function to the test file, it will fail as there is not sufficient underlying tokens to allow the initial depositor's redemption:

​
function testDepositsMaths() public setAllowedToken {
​
uint x = 1e18;
// Mint initial balance to the initial depositer
tokenA.mint(liquidityProvider, x);
AssetToken asset = thunderLoan.getAssetFromToken(tokenA);
​
​
// Liquidity provider makes a deposit
vm.startPrank(liquidityProvider);
tokenA.approve(address(thunderLoan), x);
thunderLoan.deposit(tokenA, x);
vm.stopPrank();
​
//mint to user
tokenA.mint(user, x);
​
// user makes a deposit
vm.startPrank(user);
tokenA.approve(address(thunderLoan), x);
thunderLoan.deposit(tokenA, x);
vm.stopPrank();
​
​
// user withdraws
vm.startPrank(user);
thunderLoan.redeem(tokenA, asset.balanceOf(user));
vm.stopPrank();
​
// log balances
console.log("VAULT TOKEN A BALANCE = ", tokenA.balanceOf(address(asset)));
console.log("USER 1 VAULT TOKEN BALANCE = ", asset.balanceOf(liquidityProvider));
console.log("USER 2 VAULT TOKEN BALANCE = ", asset.balanceOf(user));
console.log("USER 2 TOKEN A BALANCE = ", tokenA.balanceOf(user));
console.log("USER DEPOSITED: ", x);
​
// initial deposit withdraws
vm.startPrank(liquidityProvider);
thunderLoan.redeem(tokenA, asset.balanceOf(liquidityProvider));
vm.stopPrank();
​
}
​

Tools Used

Recommendations

Update exchange rate before minting tokens on deposits

Updates

Lead Judging Commences

0xnevi Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

can't redeem because of the update exchange rate

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.