First Flight #3: Thunder Loan

Summary

missing check isAllowedToken with token makes s_tokenToAssetToken[token] can be address(0) and the following code does nothing

Vulnerability Details

Some function does not check s_tokenToAssetToken[token] with address(0) when the user pass token params to contract

Impact

The missing check isAllowedToken with token can lead to some redundant execute code after that line with value 0

Tools Used

Manual
Foundry

Recommendations

Add check isAllowedToken(IERC20 token) for each function that allows the user to pass the token as a parameter to prevent the default value address(0) in s_tokenToAssetToken[token] mapping.