Summary

OpenZeppelin has a vault standard 4626 that can be used for depositors in Thunder Loan, and it would be safer than using your current AssetToken.sol contract. OZ's 4626 accepts an underlying asset (in our case, that would be the underlying tokens that are being flash loaned) and issues depositors shares that represent their deposit plus any additional earnings on the underlying tokens. This is perfect for depositors in ThunderLoan, and, because it is battle-tested, it would be safer than the current AssetToken.sol. For example, the exchange rate is not properly calculated in AssetToken and you could avoid that if you used 4626

Impact

You are using a non-battle-tested vault contract that is more likely to have bugs

Tools Used

Manual review

Recommendations

Change to using OpenZeppelin 4626 for your vault