Submission Details
Severity:
`Thunderloan::setAllowedToken` delete entry in mapping while not allowed will lock LP token.
Summary
If an IERC20 token is allowed then not allowed, the entry in the mapping will be deleted therefore make the redeem function for this token malfunction.
Vulnerability Details
modifier revertIfNotAllowedToken(IERC20 token) {
if (!isAllowedToken(token)) {
revert ThunderLoan__NotAllowedToken(token);
}
_;
}
this modifier will always revert in the function redeem so the underlying token will be trapped.
Impact
LP will loose their underlying token
Tools Used
read the code
Recommendations
Have a different mechanism to check allow and not allow token.
Rewards breakdown
nSLOC
387This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.