Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Thunder Loan
Submissions
AI First Flight
Thunder Loan
AI First Flight #7
Beginner Friendly
Foundry
DeFi
Oracle
EXP
AI First Flight
EXP
Mar 29th, 2026 → Apr 2nd, 2026
View repo
View results
10 / 10
Submissions
Severity
Validity
Tags
Author
#1
Repayment check uses raw balance so deposit() inside callback satisfies it, enabling fee-free flash loans
High
Valid
[H-04] All the funds can be...
virgilbb
#2
Storage slot reordering between ThunderLoan and ThunderLoanUpgraded corrupts s_flashLoanFee to 100% on upgrade
High
Valid
[H-01] Storage Collision du...
virgilbb
#3
TSwap spot price oracle used for fee calculation is manipulable in the same transaction, reducing fees to near zero
Medium
Valid
[M-02] Attacker can minimiz...
virgilbb
#4
CEI violation — exchange rate updated before token transfer lets LP-borrowers redeem at inflated rate during callback
Medium
Invalid
virgilbb
#5
deposit() calls updateExchangeRate() with a phantom fee, artificially enriching existing LPs at new depositors' expense
High
Valid
[H-02] Updating exchange ra...
virgilbb
#6
Double division in getCalculatedFee() causes near-zero fees for low-priced tokens due to intermediate precision loss
Low
Valid
[L-03] Mathematic Operation...
virgilbb
#7
IThunderLoan interface declares repay() with address type but implementation uses IERC20, causing integration type mismatches
Medium
Invalid
virgilbb
#8
Per-token flash loan flag does not guard redeem(), enabling cross-function reentrancy to extract inflated yield during callback
Medium
Invalid
virgilbb
#9
deposit() invokes TSwap oracle creating an unexpected dependency that blocks deposits when oracle is unavailable
Low
Invalid
virgilbb
#10
setAllowedToken(token, false) deletes AssetToken mapping causing revertIfNotAllowedToken to permanently block LP withdrawals
Medium
Valid
[M-01] 'ThunderLoan::setAll...
virgilbb
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
