First Flight #3: Thunder Loan

Summary

Flashloan fee could be bypassed for rebasing tokens.

Vulnerability Details

Certain ERC20 tokens have balances that can increase or decrease without any transfers. Some of them have rebasing done manually by users. In such a case, the attacker could manually trigger the rebasing, tricking flashloan() to think the fee was paid.

Impact

Attacker could get an interest free loan. Also making the exchange rate go up when it is only the rebasing happening, hence lenders getting less profits. This affects both ThunderLoan contracts.

Tools Used

Manual Review.

Recommendations

Add logic to handle rebasing tokens.