First Flight #3: Thunder Loan

Summary

Upgrading the ThunderLoan with ThunderLoanUpgraded will have storage colisions

Vulnerability Details

The storage layout of the 2 contracts differs as the Fee Precision variable is not present in the state in the second contract.
In the ThunderLoan we have(ignoring iheritance):
- slot0: s_tokenToAssetToken
- slot1: s_feePrecision
- slot2: s_flashLoanFee
- slot3: s_currentlyFlashLoaning
In the ThunderLoanUpgraded we have(ignoring iheritance):
- slot0: s_tokenToAssetToken
- slot1: s_flashLoanFee
- slot2: s_currentlyFlashLoaning
as FEE_PRECISION in ThunderLoanUpgraded is constant.

After using ThunderLoanUpgraded the fee will be 100%, as it will use the old storage. Also, s_currentlyFlashLoaning will have different references as the slots of the mapping are related to current slot

Impact

High

Tools Used

manual

Recommendations

Do not change the layout of the storage. If a change occurs, it should be present at the end