First Flight #3: Thunder Loan

Summary

The current implementation of updateFlashLoanFee is as follows :

There is no reason to add the check that verifies that newFee > s_feePrecision.

Vulnerability Details

Indeed, this checks only means the the new proposed fee by the admin shouldn't be greater than 100%. But this fee could theoretically be higher, 200% for example. This would mean , for example, that a user :

• Needs to have 1000 tokens on the contract that calls flashloan function

• In order to borrow 500 tokens from the flashloan service of the protocol

The scenario seems very unlikely, but it could still be possible. Hence, the sanity check for the proposed newFee doesn't seem necessary.

Impact

The impact is LOW as the probability of an owner setting s_flashLoanFee to more than 100% seems really low. Moreover, doing that would probably stop user from using the protocol.

Tools Used

Manual

Recommendations

I suggest to modify updateFlashLoanFee function to remove this check.

The custom error declaration should also be removed.