First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

setAllowedToken() can prevent lenders from redeeming

anarcheuz

Summary

setAllowedToken() could result in user funds being locked by the contract owner.

Vulnerability Details

setAllowedToken() will delete the address of the assetToken from the mapping s_tokenToAssetToken if allowed is set to false. If the assetToken contract still has a positive assetToken supply (meaning there are still lenders and their funds are in the contract), this would prevent these lenders from redeeming their shares.

Impact

When removing allowed tokens, lenders could be prevented from withdrawing their funds. This also affects the newer ThunderLoanUpgraded.sol.

Tools Used

Manual Review.

Recommendations

Disabling allowed tokens should only be done if the assetToken contract does not hold any user funds.

Updates

Lead Judging Commences

0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Admin Input/call validation
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

centralized owners can brick redemptions by unallowing a token

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.