First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

ThunderLoan Protocol has a solvency issue that doesn't allow all depositors to redeem their underlying tokens

coffee

Summary

As interest rates increase through use of the ThunderLoan protocol, and as liquidity providers redeem their deposited underlying tokens with gained interest; this will result in a solvency issue for the protocol and prevent some liquidity providers from redeeming their underlying tokens.

Vulnerability Details

As AssetTokens gain interest, the AssetTokens will be redeemed for more underlying tokens than what was originally deposited. This will lead to a solvency issue in the protocol and result in liquidity providers holding worthless AssetTokens as there are no underlying assets for them to be redeemed for.

function redeem(
IERC20 token,
uint256 amountOfAssetToken
)
external
revertIfZero(amountOfAssetToken)
revertIfNotAllowedToken(token)
{
AssetToken assetToken = s_tokenToAssetToken[token];
uint256 exchangeRate = assetToken.getExchangeRate();
if (amountOfAssetToken == type(uint256).max) {
amountOfAssetToken = assetToken.balanceOf(msg.sender);
}
@> uint256 amountUnderlying = (amountOfAssetToken * exchangeRate) / assetToken.EXCHANGE_RATE_PRECISION();
@> emit Redeemed(msg.sender, token, amountOfAssetToken, amountUnderlying);
assetToken.burn(msg.sender, amountOfAssetToken);
@> assetToken.transferUnderlyingTo(msg.sender, amountUnderlying);
}

Impact

The below test passes with a "ERC20: transfer amount exceeds balance" error, which proves that as depositors redeem their underlying tokens, some will be left unable to redeem as no liquidity exists in the protocol.

function testSolvencyIssueForDepositors() public setAllowedToken {
tokenA.mint(liquidityProvider, AMOUNT);
tokenA.mint(liquidityProvider2, AMOUNT);
​
vm.startPrank(liquidityProvider);
tokenA.approve(address(thunderLoan), AMOUNT);
thunderLoan.deposit(tokenA, AMOUNT);
vm.stopPrank();
​
vm.startPrank(liquidityProvider2);
tokenA.approve(address(thunderLoan), AMOUNT);
thunderLoan.deposit(tokenA, AMOUNT);
vm.stopPrank();
​
vm.startPrank(liquidityProvider);
thunderLoan.redeem(tokenA, AMOUNT);
vm.stopPrank();
​
vm.expectRevert();
vm.startPrank(liquidityProvider2);
// The below number is the amount of minted AssetToken for the 2nd depositor due to the first depositor
// increasing the interest rates
thunderLoan.redeem(tokenA, 9_970_089_730_807_577_268);
vm.stopPrank();
}

Tools Used

-Foundry

Recommendations

It is suggested that a health factor system is put into place for the entire protocol based on the AssetToken's that are minted compared to the underlying token's deposited to ensure that the protocol does not become insolvent.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

can't redeem because of the update exchange rate

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.