First Flight #3: Thunder Loan

Summary

The upgraded contract ThunderLoanUpgraded has different storage slots for s_flashLoanFee and s_feePrecision (renamed to FEE_PRECISION in upgraded contract). This causes ThunderLoanUpgraded::FEE_PRECISION to have an incorrect value and will cause incorrect fee calculations.

Vulnerability Details

Different storage layouts between implementation versions.

Impact

Incorrect fee calculation

Tools Used

• VS code diff tool

Recommendations

• Storage layouts should be the same between implementation versions

• If new storage variables needs to be added in new implementation versions, append the new storage variables to existing hierarchy.

Modify ThunderLoanUpgraded storage variables