First Flight #3: Thunder Loan

Summary

The code is attempting to update an exchange rate for an asset token based on a fee. An attacker could potentially exploit this by calling this function multiple times in quick succession.

Vulnerability Details

The reentrancy vulnerability in this code occurs because of the modification of the state (s_exchangeRate) before emitting the ExchangeRateUpdated event.

Impact

An attacker could potentially exploit this by calling this function multiple times in quick succession, and each time it's called, they could execute an external contract call, including other malicious code, before the event is emitted. This can result in unexpected and potentially harmful behavior.

Tools Used

Manual code analysis.

Recommendations