First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

confusion between loan fee and exchange rate causes redeems to fail

0xswahili

Summary

As soon as the exchangeRate is updated, functions that depend on the rate will give wrong results.

Vulnerability Details

The exchangeRate is updated by functions ie, deposits and loans. This exchangeRate is used to calculate how much of the underlying assets will be redeemed. If the exchangeRate goes up after deposit, the calculation gives a higher amount. Unfortunately, this calculates to a higher token amount than the contract is holding, meaning that the redeem will fail.
POC. Add this test to test/unit/ThunderLoanTest.t.sol

function testCantRedeemAfterDeposit() public setAllowedToken hasDeposits {
vm.startPrank(liquidityProvider);
tokenA.mint(liquidityProvider, DEPOSIT_AMOUNT);
tokenA.approve(address(thunderLoan), DEPOSIT_AMOUNT);
//vm.expectRevert();
AssetToken asset = thunderLoan.getAssetFromToken(tokenA);
//console.log(asset.getExchangeRate());
//console.log(asset.balanceOf(liquidityProvider));
thunderLoan.deposit(tokenA, DEPOSIT_AMOUNT);
//assertGt(asset.getExchangeRate() * asset.EXCHANGE_RATE_PRECISION(),asset.balanceOf(liquidityProvider));
//vm.expectRevert();
thunderLoan.redeem(tokenA, type(uint256).max);
//console.log(tokenA.balanceOf(liquidityProvider));
}

Impact

Users are unable to redeem deposits + yield

Tools Used

Manual review

Recommendations

Looks like a confusion between fee and exchange rate.

  1. Deposits and loans should not update the exchangeRate. Remove src/protocol/ThunderLoan.sol:Ln154-155

uint256 calculatedFee = getCalculatedFee(token, amount);
assetToken.updateExchangeRate(calculatedFee);

and src/protocol/ThunderLoan.sol:Ln195

assetToken.updateExchangeRate(fee);

  1. The exchange rate should not be updated. Instead, the function updateExchangeRate should be updateFee

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

can't redeem because of the update exchange rate

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.