Summary

the ThunderLoan contract and the upgradeThunderLoan contract is vulnerable to a flashloan deposit attack

Vulnerability Details

An attacker can take out a flashloan and deposit it into the contract without actually paying it back. The attacker can then withdraw the flashloan deposit.

Impact

An attacker can use this to drain all funds in the contract by taking as many flashloans as possible.

POC

https://gist.github.com/Falilah/470de5a2c297f8f775b7b24a51a28cbb

Tools Used

manual review, foundry

Recommendations

To fix this, the team should update the deposit function to check that the token is not currently flashloaning by using a modifier or use the s_currentlyFlashLoaning[token] variable to check the status of the token user want to deposit at every point in time.
suggested code to fix is as follows:
Add another error message error ThunderLoan__CurrentlyFlashLoaning(); and check in the deposit function to be sure token is not currently flashloaning before user can deposit i.e