First Flight #3: Thunder Loan

Summary

AssenToken::i_thunderLoan value cannot be changed once it is set in the constructor and all functions in AssetToken contract have the onlyThunderLoan modifier.

Vulnerability Details

Once AssenToken::i_thunderLoan is set when ThunderLoan is upgraded that variable cannot be redirected to the new address meaning that only the old implementation can be used.

Impact

If any vulnerabilities are found once this contract goes live on the Ethereum mainnet it cannot be upgraded thus if a critical vulnerability exploit is found nothing can be done to prevent its abuse.

Tools Used

Manual Review

Recommendations

Introduce a function that allows the Owner role to change what AssenToken::i_thunderLoan is set to. This will however introduce centralization risk which must be kept in mind.