First Flight #3: Thunder Loan

Summary

This vulnerability allows malicious actors to execute a reentrancy attack, which could result in the theft of underlying tokens. The impact of this issue is assessed as high, as it poses a significant risk to the protocol's funds.

Vulnerability Details

The vulnerability pertains to the interaction between the flashloan() and deposit() functions within ThunderLoan.sol. It was observed that in cases where the assetToken has a supply greater than zero, an attacker can exploit the following sequence of actions:

• Initiate a flashloan() to obtain underlying tokens from the assetToken.

• Instead of returning these tokens using the repay() function, execute a deposit(). This action includes depositing the borrowed tokens along with the associated fee.

• Subsequently, initiate a withdrawal of underlying tokens by providing the assetTokens generated during the deposit process.

As a result of this sequence, the attacker gains access to the protocol's tokens. The key issue is that the flashloan() function solely checks the assetToken balance, which does not account for the complex interaction between deposits and withdrawals.

Proof of Concept

Impact

The impact of this vulnerability is rated as high. The protocol's funds are at significant risk, as malicious actors can execute the described reentrancy attack at any time. Such an attack could lead to the theft of underlying tokens and, consequently, financial losses for the protocol.

Tools Used

Manual Review, Foundry Testing

Recommendations

To address this critical issue and mitigate the risk of reentrancy attacks, the following recommendation is made:

Consolidate the Logic: Merge the logic of the repay() function into the flashloan() function. This approach ensures that the repayment is guaranteed to occur at the end of the flashloan() transaction. This consolidation prevents attackers from bypassing the repayment phase by directly depositing funds.

By implementing this recommendation, the security of the protocol will be significantly enhanced, and the risk of reentrancy attacks will be mitigated.