First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Redeeming underlying assets linked to a deleted AssetToken will not be possible for users.

leogold

Summary

Impossible Redeeming an underlying asset for token that was previously allowed to be deposited but is not allowed again.

Vulnerability Details

setAllowedToken function set the status of a token to either true or false. setting a token in which a liquidity provider have deposited into the thunderloan contract back to false, deleting all information associated to that token including the AssetToken Liquidity provider hold as a receipt to redeem their asset will render the AssetToken useless as the underlying Token associated with the AssetToken is no longer a valid token in the contract and in turn will get liquidity provider funds stuck in the contract forever.

Impact

  1. Liquidity Provider funds get stucked in the contract forever

POC

Add the function below to thunderloan.t.sol

function testFailsetAllowedTokenToFalse()
public
setAllowedToken
hasDeposits
{
AssetToken assetToken = thunderLoan.getAssetFromToken(tokenA);
​
vm.startPrank(user);
tokenA.mint(address(user), AMOUNT);
tokenA.approve(address(thunderLoan), AMOUNT);
​
thunderLoan.deposit(tokenA, AMOUNT);
vm.stopPrank();
​
// set deposited Token back to false
vm.prank(thunderLoan.owner());
thunderLoan.setAllowedToken(tokenA, false);
​
// user try to Redeem UnderlyingToken and got denied
vm.prank(user);
thunderLoan.redeem(tokenA, assetToken.balanceOf(user));
}

run with forge test --mt testFailsetAllowedTokenToFalse -vvvv

Tools Used

foundry

Recommendations

The team should make sure Liquidity Provider who have deposited into the contract when it accept the token should still be able to withdraw their token when it does not accept it again to avoid stucking funds in the contract.
They can also check the AssetToken contract attached to that underlying token is not holding any amount of the underlying Token before removing it from allowedToken.

Updates

Lead Judging Commences

0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Admin Input/call validation
leogold Submitter
over 1 year ago
0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

centralized owners can brick redemptions by unallowing a token

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.