First Flight #3: Thunder Loan

Summary

It's possible for loans' fee to be zero.

Vulnerability Details

Because any type of ERC20 tokens could be used, there could come a scenario where its price in ETH or its decimals are both very small. In that case: getCalculatedFee() will give a value of zero for valueOfBorrowedToken and fee.
This means that no fees would be collected for the loan, and although the amount loaned is very small, an attacker can re-enter many times flashloan() to make a lot of small interest-free loans which together make a big amount being loaned. This is medium because it is a specific scenario.

Impact

An attacker can make a lot of small loans to avoid the fees that he would have to pay on the total amount loaned if he only made 1 loan. This affects both ThunderLoan contracts.

Tools Used

Manual Review.

Recommendations

Introduce a minimum fee or loan amount.