Summary

The deposit function in ThunderLoan uses getExchangeRate function fron AssetToken.sol contract which will always return zero. The reason it returns zero is because s_exchangeRate in uninitialized which makes solidity take it as zero. This results in any amount that is entered into by users being multiplied by zero, meaning users will be making deposits but the contract automatically makes it zero. The line that makes it zero is L149 and L150 of the ThunderLoan.sol contract. Code:
`uint256 exchangeRate = assetToken.getExchangeRate();

uint256 mintAmount = (amount * assetToken.EXCHANGE_RATE_PRECISION());`

Vulnerability Details

Impact

Tools Used

Manual Review

Recommendations

Provisions should be made to set what the s_exchangeRate in TokenAssets contract.