First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

[H-4] Lack of interface usage

Dutch

Summary

In ThunderLoan.sol:134, the current implementation uses a low-level functionCall to interact with a flash loan receiver. However, a dedicated interface for the flash loan receiver exists which is not being utilized. Using the interface would lead to safer and more predictable code by ensuring only intended functions can be called and parameters are passed correctly.

Vulnerability Details

Vulnerable code:

function flashloan(address receiverAddress, IERC20 token, uint256 amount, bytes calldata params) external {
​
uint256 startingBalance = IERC20(token).balanceOf(address(assetToken));
​
if (amount > startingBalance) {
revert ThunderLoan__NotEnoughTokenBalance(startingBalance, amount);
}
​
if (!receiverAddress.isContract()) {
revert ThunderLoan__CallerIsNotContract();
}
​
​
uint256 fee = getCalculatedFee(token, amount);
// slither-disable-next-line reentrancy-vulnerabilities-2 reentrancy-vulnerabilities-3
assetToken.updateExchangeRate(fee);
​
emit FlashLoan(receiverAddress, token, amount, fee, params);
​
s_currentlyFlashLoaning[token] = true;
assetToken.transferUnderlyingTo(receiverAddress, amount);
// slither-disable-next-line unused-return reentrancy-vulnerabilities-2
// @audit-issue [H-6] we have a interface for the flashloan receiver but we are not using it! Use that instead of the lowlevel functioncall method
receiverAddress.functionCall(
abi.encodeWithSignature(
"executeOperation(address,uint256,uint256,address,bytes)",
address(token),
amount,
fee,
msg.sender,
params
)
);
​
uint256 endingBalance = token.balanceOf(address(assetToken));
if (endingBalance < startingBalance + fee) {
revert ThunderLoan__NotPaidBack(startingBalance + fee, endingBalance);
}
s_currentlyFlashLoaning[token] = false;
}

Impact

  1. The lack of interface usage for the flash loan receiver increases the risk of unexpected behavior and vulnerabilities such as reentrancy attacks. Low-level calls should be avoided when high-level abstractions are available, as they do not perform argument count or value checks, increasing the risk of errors.

Tools Used

  1. Manual Review

  2. Vs Code

Recommendations

It is recommended to modify the smart contract to use the existing flash loan receiver interface instead of the low-level functionCall method. The interface enforces the contract to adhere to specific method signatures and parameter types, which mitigates potential security risks associated with arbitrary function calls. The code segment handling the interaction with the flash loan receiver should be replaced with an interface call like this:

// First, define the IFlashLoanReceiver interface with the executeOperation function
interface IFlashLoanReceiver {
function executeOperation(
address token,
uint256 amount,
uint256 fee,
address sender,
bytes calldata params
) external returns (bool);
}
​
// Then, in the executeOperation function within ThunderLoan.sol:
IFlashLoanReceiver receiver = IFlashLoanReceiver(receiverAddress);
require(receiver.executeOperation(
address(token),
amount,
fee,
msg.sender,
params
), "Flashloan execution failed");
Updates

Lead Judging Commences

0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.