Thunder Loan
AI First Flight #7
Beginner FriendlyFoundryDeFiOracle
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

Nested same-token flashloans can desync boolean loan state and break outer repay path

0xsnoweth

Root + Impact

Description

Normal behavior: nested loan behavior should either be safely supported or clearly rejected before callback execution.

Issue: a single boolean s_currentlyFlashLoaning[token] tracks loan state. In nested same-token loans, inner completion sets flag false before outer callback ends, causing outer repay() to revert with NotCurrentlyFlashLoaning.

// src/protocol/ThunderLoan.sol
s_currentlyFlashLoaning[token] = true;
...
if (!s_currentlyFlashLoaning[token]) {
revert ThunderLoan__NotCurrentlyFlashLoaning();
}
...
s_currentlyFlashLoaning[token] = false; // @> inner call can clear state needed by outer call

Risk (Likelihood/Impact)

Likelihood:

  • Triggered by nested same-token integrations.

  • Current state model uses one boolean instead of loan-depth/context tracking.

Impact:

  • Liveness/integration fragility for nested callbacks.

  • Not demonstrated as direct theft in validated PoC, but repay pathway fails.

Proof of Concept

Validated PoC: test/audit/ThirdPassDelta.t.sol::test_I01_NestedSameTokenFlashloan_RepayPathStateDesyncReverts (PASS).

vm.expectRevert();
tl.flashloan(address(receiver), IERC20(address(token6)), outerAmount, "");

Recommended Mitigation

  • Track per-token loan depth counter or per-loan context IDs.

  • Alternatively disallow nested same-token flashloans with explicit upfront revert.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 10 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!