First Flight #3: Thunder Loan

Summary

The old version ThunderLoan.sol has an incorrect exchange rate update in deposit().

Vulnerability Details

The exchange rate should only be updated in the flashloan() function as the fees collected make it so that lenders have profits. Indeed, as the fees increase, the lenders can redeem their assetToken for a bigger exchange rate. When updating in the deposit() function, the exchange rate goes up when actually there is no additional profits. Take this scenario for example: users deposit then all users withdraw. The last ones to withdraw will be in a situation where there wont be enough funds for them to withdraw their deposit. That is because the first withdrawals were done at a higher exchange rate.

Impact

Users will be unable to withdraw their original deposit.

Tools Used

Manual Review.

Recommendations

Use the ThunderLoanUpgrade.sol implementation of deposit().