Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Submission Details
Severity: high
Valid

Exchange rate should not change due to a deposit.

Summary

Exchange rate should not change due to a deposit. But in reality, calling the "deposit" function in ThunderLoan.sol leads to an increase in the exchange rate.

Vulnerability Details

The documentation of the protocol states that "these AssetTokens gain interest over time depending on how often people take out flash loans". The exchange rate grows due to the fact that users pay a fee on loans. But in the "deposit" function, the depositor does not pay anything, but simply invests his funds, so the growth of the exchange rate is artificial.

Impact

This can break the functionality of the protocol: incorrect rate, unfair distribution of AssetTokens, calculation problems.

Tools Used

Manual rewiew.

Recommendations

Recommended to remove these lines of code in the "deposit" function:
///solidity
uint256 calculatedFee = getCalculatedFee(token, amount);
assetToken.updateExchangeRate(calculatedFee);
///

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

can't redeem because of the update exchange rate

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.