Thunder Loan
AI First Flight #7
Beginner FriendlyFoundryDeFiOracle
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Exchange-rate inflation composition can force zero-share victim deposits and redemption failure

0xsnoweth

Root + Impact

Description

Normal behavior: depositing non-zero underlying should mint non-zero shares for typical amounts, and redemption should remain live for valid share holders.

Issue: with tiny share supply plus large donated liquidity and repeated fee-driven exchange-rate updates, exchange rate can inflate to extreme values. Later normal deposits can round down to zero shares while still transferring underlying; redemption path becomes economically broken in PoC flow.

// src/protocol/AssetToken.sol
uint256 newExchangeRate = s_exchangeRate * (totalSupply() + fee) / totalSupply();
​
// src/protocol/ThunderLoan.sol::deposit
uint256 mintAmount = (amount * assetToken.EXCHANGE_RATE_PRECISION()) / exchangeRate; // @> can round to 0
assetToken.mint(msg.sender, mintAmount);

Risk (Likelihood/Impact)

Likelihood:

  • Requires specific but feasible composition (tiny initial supply, direct donation, repeated flash fee updates).

  • No min-share mint guard prevents zero-share deposit acceptance.

Impact:

  • Victim can transfer assets and receive zero shares.

  • Accounting can become unrecoverable; redemptions may revert in inflated state.

Proof of Concept

Validated PoC: test/audit/FreeAuditMaxYield.t.sol::test_M04_ExchangeRateInflationCanForceVictimZeroShareMint (PASS).

assertGt(exchangeRate, 1e36);
tl.deposit(token, 1e18);
assertEq(asset.balanceOf(victim), 0);
assertEq(token.balanceOf(victim), 0);
vm.expectRevert();
tl.redeem(token, attackerShares);

Recommended Mitigation

  • Add minimum-share-out checks on deposit (revert when mintAmount == 0).

  • Isolate/limit exchange-rate updates to realized, bounded fee events and harden against donation+tiny-supply amplification.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 10 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!