First Flight #3: Thunder Loan

Summary

When depositors deposit the underlying tokens, they receive asset token shares back and when they redeem, they trade their asset tokens back into the underlying tokens. In both cases, the depositor should be able to enter maximum slippage (or a mininmum amount of asset token or token to be received) such that the transaction will revert if they are not satisified with the slippage.

Vulnerability Details

The deposit and redeem function don't have an option to enter maximum slippage or minimum tokens/asset tokens to receive.

Impact

Depositors could get bad exchange rates and also be susceptible to front-running.

Tools Used

Manual review

Recommendations

Add an additional input for deposit of uint256 minimumAssetTokens and then add the following to the deposit function (after calculation of mintAmount):

Add an additional parameter to the redeem function of uint256 minimumUnderlyingTokens and add the following to the redeem function (after amountUnderlying is calculated):