First Flight #3: Thunder Loan

Summary

Potential vulnerable to readonly-reentrancy function

Vulnerability Details

ThunderLoan.isCurrentlyFlashLoaning(IERC20) (src/protocol/ThunderLoan.sol#268-270):
State variables read that were written after the external call(s):

• ThunderLoan.s_currentlyFlashLoaning (src/protocol/ThunderLoan.sol#99) was read at s_currentlyFlashLoaning[token] (src/protocol/ThunderLoan.sol#269)

This variable was written at (after external call):

• s_currentlyFlashLoaning[token] = true

• s_currentlyFlashLoaning[token] = false (src/protocol/ThunderLoan.sol#216)

Impact

The Token might be minted wrongly as a rewards due to the reentrancy attack.

Tools Used

Slither, Manual Review

Recommendations

Recommend adding the nonReentrant modifer