First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Piramidal Scheme

bbcrypt

Summary

The Vulnerability is present in the ThunderLoan Contract, and it is solved in the ThunderLoanUpgraded
Redeeming will return more tokens without any flashloans, as deposit function will update the exchange rate.

Vulnerability Details

There are 2 scenarios:

  • Single depositor, and wants to redeem. This will not be possible, as if he wants to convert all the AssetTokens to Underlying it will revert. This is caused by increasing the exchange rate without accumulate any fees in the contract.

Impact

Low - I think that if it is fixed in the new contract, ThunderLoanUpgraded, I can't put a higher severity. If it wasn't, I think a medium can work, as if multiple deposits are placed, not everybody can redeem not even their initial deposited amount, as it will take by others that redeemed before him.
Some feedback here please :)

Tools Used

manual, unit test

Recommendations

Remove updating the exchange rate in the deposit function

PoC:

​
modifier setAllowedToken() {
vm.prank(thunderLoan.owner());
thunderLoan.setAllowedToken(tokenA, true);
_;
}
​
function test_DepositAndRedeem() external setAllowedToken{
// create the victim address
address bob = makeAddr('bob');
​
// mint a initial amount of tokens to it
tokenA.mint(bob, 10 ether);
​
// get the asset token of the tokenA
AssetToken assetToken = thunderLoan.getAssetFromToken(tokenA);
​
vm.startPrank(bob);
​
// approval for the protocol to move tokens from the victim
tokenA.approve(address(thunderLoan), 100 ether);
​
// deposit tokens into the protocol
thunderLoan.deposit(tokenA, 10 ether);
​
// check how much assetTokens are minted
uint256 bobBalanceAssetToken = assetToken.balanceOf(bob);
assertEq(bobBalanceAssetToken, 10 ether * assetToken.EXCHANGE_RATE_PRECISION());
console.log(bobBalanceAssetToken);
​
// victim reconsiders their deposit and wants the tokens back
// this will revert as the underlying amount is calculated with an increased exchange rate(modified on deposit)
thunderLoan.redeem(tokenA, bobBalanceAssetToken);
vm.stopPrank();
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

can't redeem because of the update exchange rate

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.