Thunder Loan
AI First Flight #7
Beginner FriendlyFoundryDeFiOracle
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

flashloan() allows zero-amount loans due to missing input validation

actlysis

Root + Impact

Description

  • The flashloan() function is designed to allow users to borrow tokens as long as they are repaid with a fee within the same transaction.

  • However, the function does not validate that the amount is greater than zero, allowing zero-value flashloans to be executed.

// Root cause in the codebase with @> marks to highlight the relevant section
​
function flashloan(address receiverAddress, IERC20 token, uint256 amount, bytes calldata params) external {
AssetToken assetToken = s_tokenToAssetToken[token];
​
uint256 startingBalance = IERC20(token).balanceOf(address(assetToken));
​
if (amount > startingBalance) {
revert ThunderLoan__NotEnoughTokenBalance(startingBalance, amount);
}
​
// @> No validation that amount > 0
​
if (!receiverAddress.isContract()) {
revert ThunderLoan__CallerIsNotContract();
}
​
uint256 fee = getCalculatedFee(token, amount);
​
assetToken.updateExchangeRate(fee);
​
s_currentlyFlashLoaning[token] = true;
assetToken.transferUnderlyingTo(receiverAddress, amount);
}

Risk

Likelihood:

  • Function is externally callable with arbitrary parameters

  • No restriction prevents zero-value flashloans

Impact:

  • Unnecessary execution and gas consumption for no-op transactions

  • Potential inconsistencies if other logic assumes non-zero amounts

Proof of Concept

  • Zero-value flashloan executes without reverting

flashloan(address(this), token, 0, "");

  • Behavior:

    • No tokens are transferred

    • Function still executes core logic including fee calculation and state updates

Recommended Mitigation

  • Enforce non-zero amount using existing validation helper

function flashloan(address receiverAddress, IERC20 token, uint256 amount, bytes calldata params) external {
+ revertIfZero(amount);
​
AssetToken assetToken = s_tokenToAssetToken[token];
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 13 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!