Thunder Loan
AI First Flight #7
Beginner FriendlyFoundryDeFiOracle
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Missing event emission in repay() reduces transparency of flashloan repayments

actlysis

Root + Impact

Description

  • The repay() function is responsible for handling repayment of flashloans by transferring tokens back to the protocol.

  • However, the function does not emit any event upon successful repayment, reducing on-chain transparency and making it harder to track repayments.

// Root cause in the codebase with @> marks to highlight the relevant section
​
function repay(IERC20 token, uint256 amount) public {
if (!s_currentlyFlashLoaning[token]) {
revert ThunderLoan__NotCurrentlyFlashLoaning();
}
​
AssetToken assetToken = s_tokenToAssetToken[IERC20(token)];
​
// @> No event emitted for repayment tracking
token.safeTransferFrom(msg.sender, address(assetToken), amount);
}

Risk

Likelihood:

  • Function is called on every flashloan repayment

  • No logging mechanism exists for these interactions

Impact:

  • Off-chain services cannot easily track repayments

  • Reduced transparency for users and auditors

  • Makes debugging and monitoring more difficult

Proof of Concept

  • Execute a flashloan and repay:

repay(token, amount);

  • Observe:

    • Tokens are transferred successfully

    • ❌ No event is emitted

Recommended Mitigation

  • Emit an event when a repayment occurs

+ event FlashLoanRepaid(address indexed payer, address indexed token, uint256 amount);
​
function repay(IERC20 token, uint256 amount) public {
if (!s_currentlyFlashLoaning[token]) {
revert ThunderLoan__NotCurrentlyFlashLoaning();
}
​
AssetToken assetToken = s_tokenToAssetToken[IERC20(token)];
​
token.safeTransferFrom(msg.sender, address(assetToken), amount);
​
+ emit FlashLoanRepaid(msg.sender, address(token), amount);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 13 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!