First Flight #3: Thunder Loan

Summary

The owner (or attacker who steals the owner's wallet) can call ThunderLoan#setAllowedToken() to set his own token for the depositing. Also he can call ThunderLoan#updateFlashLoanFee() to update new flash loan fee for the protocol.
ThunderLoanUpgraded contract contains the same issues.

Impact

Many deposit() and redeem() transactions will fail due to insufficient allowed token amount. Users could be charged more when calling flashloan() function.

Tools Used

Manual review.

Recommendations

The owner of the contract should be a timelock contract.