First Flight #3: Thunder Loan

Summary

Pausable tokens may cause unexpected behaviors

Vulnerability Details

Tokens like BNB and ZIL are pausable. This implies the amount that transfers into and out of the protocol may be disabled for these tokens at any time without warning to the protocol and users.

Impact

If tokens paused it implies that transfer of these tokens from users to use the protocol e.g deposits will not work and additionally transfers out to redeem underlying will not work as indicated in link attached. Hence the protocol is unusable and users cant get back their funds

Tools Used

Manual Analysis
Weird ERC20 Tokens => https://github.com/d-xo/weird-erc20

Recommendations

Recommended to exclude these tokens via the whitelist
Recommend plausibility and emergency patterns for the protocol