Root + Impact

Description

• 
  ThunderLoan::updateFlashLoanFee lets onlyOwner set s_flashLoanFee
  to anything up to s_feePrecision (i.e. up to 100%) instantly, with no timelock and no notice to
  active users. Separately, _authorizeUpgrade gates UUPS upgrades with only onlyOwner, so
  the same key can swap out the entire implementation at any time (as demonstrated by the storage‑
  collision scenario in [H‑1])

Risk

Likelihood:

• A single compromised, malicious, or simply mistaken owner key can (1) front‑run/grief a
  pending flash loan by spiking the fee toward 100% right before it executes, or (2) push an arbitrary
  new implementation via upgradeTo with no window for LPs to react or exit beforehand:

• Impact 1

  A single compromised, malicious, or simply mistaken owner key can (1) front‑run/grief a
  pending flash loan by spiking the fee toward 100% right before it executes, or (2) push an arbitrary
  new implementation via upgradeTo with no window for LPs to react or exit beforehand

Proof of Concept

Recommended Mitigation