First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

There is no check that a depositor has the correct asset tokens in the correct amount in their wallet before redeeming

happyformerlawyer

Summary

The redeem function does not confirm that a depositor (or an attacker) has the amount of asset tokens in their wallet that they are trying to redeem. You could try to redeem tokens in the Asset Token contract that you did not deposit, and it might

Vulnerability Details

Test

I wrote a test to see if an attacker could redeem tokens for which they did not have corresponding asset tokens, and it did fail because there was an insufficient balance of asset tokens to be burned, but the burn could also fail silently and then the attacker could potentially receive underlying tokens that they didn't have a right to, and this could be prevented by validating that they have amountOfAssetToken

function testAttackerRedeemDepositorsDeposits()
public
setAllowedToken
hasDeposits
{
vm.startPrank(lp2);
thunderLoan.redeem(tokenA, AMOUNT);
vm.stopPrank();
console.log("lp2 balance:", tokenA.balanceOf(lp2));
assertEq(tokenA.balanceOf(lp2), 0);
}

I also wrote this test to see if a depositor could redeem tokens different than the ones they deposited and this one failed for the same reason

function testRedeemDepositsOfOtherTokens()
public
setAllowedToken
hasDeposits
{
vm.prank(thunderLoan.owner());
thunderLoan.setAllowedToken(tokenB, true);
vm.startPrank(liquidityProvider);
thunderLoan.redeem(tokenB, AMOUNT);
vm.stopPrank();
console.log("lp2 balance:", tokenB.balanceOf(liquidityProvider));
assertEq(tokenB.balanceOf(liquidityProvider), 0);
}

Impact

A person who does not have sufficient asset tokens who tries to call redeem should be reverted immediately. There is no good reason a person who doesn't have sufficient asset tokens should be calling redeem and it only opens up potential attack surface to allow the function call to be processed.

Tools Used

Manual review
Foundry

Recommendations

Add a check at the beginning of the redeem function:

if(assetToken.balanceOf(msg.sender) < amountofAssetToken) {
revert ThunderLoan__InsufficientAssetTokens();}
Updates

Lead Judging Commences

0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.