Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Thunder Loan
Submissions
AI First Flight
Thunder Loan
AI First Flight #7
Beginner Friendly
Foundry
DeFi
Oracle
EXP
AI First Flight
EXP
Oct 10th, 2026 → Oct 12th, 2026
View repo
View results
10 / 10
Submissions
Severity
Validity
Tags
Author
#1
flashloan() accepts deposit() as repayment, so the borrower is minted AssetTokens for the borrowed funds and can redeem the entire pool (ThunderLoan and ThunderLoanUpgraded)
High
Valid
[H-04] All the funds can be...
friedsocks233
#2
ThunderLoan.deposit raises the AssetToken exchange rate by a 0.3% fee that is never paid, so the pool is insolvent after every deposit and an atomic deposit/redeem drains other LPs' principal
High
Valid
[H-02] Updating exchange ra...
friedsocks233
#3
ThunderLoanUpgraded drops the s_feePrecision storage slot, so after the planned upgrade s_flashLoanFee reads V1's precision value (1e18) and the flash-loan fee rises from 0.3% to 100% of the borrowed value
High
Valid
[H-01] Storage Collision du...
friedsocks233
#4
Reentrant flashloan() credits each nested loan's fee to LPs but checks repayment only against its own balance snapshot, so the inner fee is never paid: borrowers evade fees, the pool goes insolvent and a large LP can take other LPs' principal
Medium
Invalid
friedsocks233
#5
getCalculatedFee takes 0.3% of a loan's WETH value but collects it in borrowed-token units, so the fee scales with token price: cheap tokens pay ~1/2000 of the LP fee, tokens above ~333 WETH pay more than the principal
Medium
Invalid
friedsocks233
#6
Flash-loan fee is priced from a live TSwap spot price, so a borrower can depress the price in the same transaction and pay under 1% of the fee, cutting LP yield (ThunderLoan and ThunderLoanUpgraded)
Medium
Valid
[M-02] Attacker can minimiz...
friedsocks233
#7
AssetToken.updateExchangeRate multiplies the rate by (totalSupply + fee)/totalSupply, so each fee credits LPs fee*rate instead of fee; once rate > 1e18 LP claims outgrow pool assets and the last redeemers lose principal
Medium
Invalid
friedsocks233
#8
deposit() mints AssetToken shares for the nominal amount, not the amount the pool received, so README-listed fee-on-transfer tokens (STA, PAXG) leave the pool under-backed and the last LPs cannot redeem their principal
Medium
Valid
[M-03] `ThunderLoan:: depos...
friedsocks233
#9
Delisting a token via setAllowedToken(token, false) deletes the only reference to its AssetToken, so redeem() reverts for every LP and all principal and fees stay frozen until the owner deploys a custom upgrade
Medium
Valid
[M-01] 'ThunderLoan::setAll...
friedsocks233
#10
s_currentlyFlashLoaning is a per-token bool, not a depth counter, so a nested same-token flash loan clears it on exit and the outer loan's repay() reverts with ThunderLoan__NotCurrentlyFlashLoaning
Low
Invalid
friedsocks233
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
