Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Thunder Loan
Submissions
AI First Flight
Thunder Loan
AI First Flight #7
Beginner Friendly
Foundry
DeFi
Oracle
EXP
AI First Flight
EXP
Apr 4th, 2026 → Apr 4th, 2026
View repo
View results
10 / 10
Submissions
Severity
Validity
Tags
Author
#1
Repayment check uses raw balance so deposit() inside callback satisfies it, enabling fee-free flash loans
High
Valid
[H-04] All the funds can be...
virgilbb
#2
Storage slot reordering between ThunderLoan and ThunderLoanUpgraded corrupts s_flashLoanFee to 100% on upgrade
High
Valid
[H-01] Storage Collision du...
virgilbb
#3
TSwap spot price oracle used for fee calculation is manipulable in the same transaction, reducing fees to near zero
Medium
Valid
[M-02] Attacker can minimiz...
virgilbb
#4
getCalculatedFee() assumes 18 decimals, causing fees to be ~1e12x smaller for non-standard tokens like USDT
High
Valid
[H-03] fee are less for non...
virgilbb
#5
deposit() calls updateExchangeRate() with a phantom fee, artificially enriching existing LPs at new depositors' expense
High
Valid
[H-02] Updating exchange ra...
virgilbb
#6
deposit() mints shares based on nominal amount but fee-on-transfer tokens deliver less, inflating exchange rate and stealing from new depositors
Medium
Invalid
virgilbb
#7
setAllowedToken(token, false) deletes AssetToken mapping causing revertIfNotAllowedToken to permanently block LP withdrawals
Medium
Valid
[M-01] 'ThunderLoan::setAll...
virgilbb
#8
getCalculatedFee() returns 0 for small or low-priced token amounts, enabling free flash loans
Low
Valid
[L-01] getCalculatedFee can...
virgilbb
#9
updateFlashLoanFee() emits no event, making fee changes undetectable off-chain
Low
Valid
[L-02] updateFlashLoanFee()...
virgilbb
#10
Divide-before-multiply in getCalculatedFee() causes precision loss and undercollects fees
Low
Valid
[L-03] Mathematic Operation...
virgilbb
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
