First Flight #3: Thunder Loan

Summary

Vulnerability Details

The check-effect interaction was not properly followed in the deposit function as state variable were updated before getting the fund from users which is a bad practice as it can be dangerous to the protocol and users.

Impact

Liquidity Provider tends to waste gas before realizing they don't have enough or haven't approved the protocol to spend the funds

Tools Used

Manual review

Recommendations

The team should confirm a transferfrom function was successful from the liquidity provider before updating the state of the contract.