First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`exchangerate` calculation in `redeem()` function

Nocturnus

Summary

Users can redeem their deposited tokens with an increased exchange rate. This means each time a flashloan is taken exchangerate will increase and users can receive more underlying tokens according to below line from the redeem() function

uint256 amountUnderlying = (amountOfAssetToken * exchangeRate) / assetToken.EXCHANGE_RATE_PRECISION();

Vulnerability Details

The fee in the protocol is earned when a user takes a flashloan. The protocol does not earn an increased rate of fees in each flashloan, it's a fixed amount of 0.3%.

Impact

Below is the PoC to prove. The fee income from the flashloan activity will not be enough to afford increasing exchange rates

function testNCTLiquidtyProviderCannotRedeem() public setAllowedToken {
vm.startPrank(liquidityProvider);
tokenA.mint(liquidityProvider, DEPOSIT_AMOUNT);
tokenA.approve(address(thunderLoan), DEPOSIT_AMOUNT);
thunderLoan.deposit(tokenA, DEPOSIT_AMOUNT);
vm.stopPrank();
uint256 amountToBorrow = AMOUNT * 10;
vm.startPrank(user);
tokenA.mint(address(mockFlashLoanReceiver), AMOUNT);
thunderLoan.flashloan(address(mockFlashLoanReceiver),tokenA,amountToBorrow,"");
vm.stopPrank();
vm.startPrank(user);
tokenA.mint(address(mockFlashLoanReceiver), AMOUNT);
thunderLoan.flashloan(address(mockFlashLoanReceiver),tokenA,amountToBorrow,"");
vm.stopPrank();
vm.startPrank(liquidityProvider);
vm.expectRevert("ERC20: transfer amount exceeds balance");
thunderLoan.redeem(tokenA, (type(uint256).max));
vm.stopPrank();
}

Tools Used

  • manual code review

  • foundry

Recommendations

Increasing exchange rate should not be used.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

can't redeem because of the update exchange rate

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.