Thunder Loan
AI First Flight #7
Beginner FriendlyFoundryDeFiOracle
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

`updateFlashLoanFee` Has No Lower Bound, Owner Can Set Fee to 0

samuraiigintokii

[M-1] updateFlashLoanFee Has No Lower Bound, Owner Can Set Fee to 0

Field Value
Severity Medium
Location src/protocol/ThunderLoan.sol lines 252–256

Description

updateFlashLoanFee only checks newFee > s_feePrecision (upper bound). There is no check for newFee == 0 or any minimum threshold. The owner can set the fee to 0 instantly with no timelock.

Impact

  • Centralization risk: owner can unilaterally destroy LP yield.

  • No rational LP would deposit if fees can be zeroed at any moment.

Recommended Mitigation

+uint256 public constant MINIMUM_FEE = 1e15; // 0.1%
​
function updateFlashLoanFee(uint256 newFee) external onlyOwner {
+ if (newFee < MINIMUM_FEE) {
+ revert ThunderLoan__FeeBelowMinimum();
+ }
if (newFee > s_feePrecision) {
revert ThunderLoan__BadNewFee();
}
s_flashLoanFee = newFee;
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 6 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!