First Flight #3: Thunder Loan

Summary

Exchange rate should not change due to a deposit. But in reality, calling the "deposit" function in ThunderLoan.sol leads to an increase in the exchange rate.

Vulnerability Details

The documentation of the protocol states that "these AssetTokens gain interest over time depending on how often people take out flash loans". The exchange rate grows due to the fact that users pay a fee on loans. But in the "deposit" function, the depositor does not pay anything, but simply invests his funds, so the growth of the exchange rate is artificial.

Impact

This can break the functionality of the protocol: incorrect rate, unfair distribution of AssetTokens, calculation problems.

Tools Used

Manual rewiew.

Recommendations

Recommended to remove these lines of code in the "deposit" function:
///solidity
uint256 calculatedFee = getCalculatedFee(token, amount);
assetToken.updateExchangeRate(calculatedFee);
///