[L-03] Empty _authorizeUpgrade() — No Upgrade Safety Checks

Scope

• ThunderLoan.sol

• ThunderLoanUpgraded.sol

Description

The UUPS _authorizeUpgrade() function has an empty body, relying solely on the onlyOwner modifier inherited from OwnableUpgradeable. There are no additional safety checks such as timelock enforcement, multi-sig requirement, or new implementation validation.

Risk

Likelihood: Low — requires owner key compromise.
Impact: High — a compromised owner key can immediately upgrade to a malicious implementation without any delay or validation.
Severity: Low

Proof of Concept

A compromised owner can call upgradeTo(maliciousAddress) in a single transaction, immediately replacing the entire protocol logic without any warning, timelock, or governance process.

Recommended Mitigation

Add implementation validation inside _authorizeUpgrade() to ensure the new implementation is non-zero and conforms to the expected interface. This prevents accidentally upgrading to an incompatible or empty contract. For additional safety, consider wrapping the upgrade behind a timelock or multi-sig governance contract.