First Flight #3: Thunder Loan

Summary

The smart contract suffers from a critical state variable storage collision issue where the order of the state variables s_feePrecision and s_flashLoanFee has been switched inadvertently in an upgrade. This misalignment in storage slots leads to critical vulnerabilities, allowing the potential mishandling of fee calculations and the disruption of contract functionality.

Vulnerability Details

State variables in Ethereum smart contracts are stored contiguously in storage slots. In upgradeable contracts, the storage layout must remain consistent across versions. If the order of state variables changes during an upgrade, the values previously stored in those slots can be misinterpreted, leading to incorrect behavior and potential vulnerabilities.

In this specific contract, the s_feePrecision was intended to define the precision for fee calculations, while s_flashLoanFee was used to track the fee for flash loans. After the upgrade, their storage slots were swapped, leading to the following problems:

• Fee Calculation Errors: The values intended for precision control are now mistakenly used in fee calculations.

• Misleading Fee Handling: The fees for flash loans could be inaccurately calculated, causing economic damage to the contract's users or the owner.

• Incorrect State Assumptions: Logic that relied on the correct state could revert or behave unexpectedly.

Impact

The impact of this vulnerability is significant. It can lead to the following scenarios:

• Incorrect fee calculations for flash loans, which could result in financial losses for either the contract's users or the contract owner.

• Disruption of contract operations due to incorrect assumptions about the state.

• Loss of trust in the contract's functionality from its users.

Tools Used

Foundry

Recommendations

To address this issue, the state variables should be reverted to their original order within the next contract upgrade. This realignment will prevent the incorrect interpretation of stored values, ensuring that fee calculations and contract logic operate as intended.