First Flight #3: Thunder Loan

Summary

If the ThunderLoan contract is upgraded to ThunderLoanUpgraded in the future, the updateExchangeRate function will not be accessible to the upgraded contract. This is because the updateExchangeRate function has an onlyThunderLoan modifier, which permits access exclusively to the ThunderLoan contract and does not extend to its upgraded counterpart, ThunderLoanUpgraded."

Vulnerability Details

The vulnerability in the contract lies in its upgradeability mechanism. Specifically, if the ThunderLoan contract is upgraded to ThunderLoanUpgraded in the future, the updateExchangeRate function within the AssetToken contract will no longer be accessible to the upgraded contract. The primary reason for this is the presence of the onlyThunderLoan modifier, which restricts access to the ThunderLoan contract exclusively & does not include the upgraded version, ThunderLoanUpgraded.

Impact

The inability of the ThunderLoanUpgraded contract to access the updateExchangeRate function may lead to loss of key functionality, including the ability to enable users to perform flash loans, resulting in a significant impact on the platform's operation.

Tools Used

• Foundry and manual review

Recommendations

To address the issue, you should:

1. Modify the onlyThunderLoan modifier to include ThunderLoanUpgraded for access to the updateExchangeRate function.

2. Implement a proxy pattern for consistent functionality across both contracts.

3. Ensure backward compatibility to avoid disrupting existing features.

4. Rigorously test the modified contracts for security.

5. Provide clear upgrade documentation for users.

Change onlyThunderLoan code to the below to include ThunderLoanUpgraded for access to the updateExchangeRate function.