Thunder Loan

escription

setAllowedToken(token, false) unconditionally deletes the mapping from token to its AssetToken contract. The redeem() function requires the token to pass the
revertIfNotAllowedToken modifier, which checks address(s_tokenToAssetToken[token]) != address(0). After the mapping is deleted, this check always reverts —
regardless of how many underlying tokens LP depositors have locked inside.

There is no mechanism to redeem through the old AssetToken directly, and no grace period or rescue function.

// ThunderLoan.sol
function setAllowedToken(IERC20 token, bool allowed) external onlyOwner returns (AssetToken) {
// ...
} else {
AssetToken assetToken = s_tokenToAssetToken[token];
// @> mapping deleted — AssetToken address no longer findable via protocol
delete s_tokenToAssetToken[token];
emit AllowedTokenSet(token, assetToken, allowed);
return assetToken;
}
}

function redeem(
IERC20 token,
uint256 amountOfAssetToken
)
external
revertIfZero(amountOfAssetToken)
// @> this modifier reverts if s_tokenToAssetToken[token] == address(0)
revertIfNotAllowedToken(token)
{
AssetToken assetToken = s_tokenToAssetToken[token];
// @> assetToken is now address(0) — any call here would also revert
// ...
}

Risk

Likelihood:

• The owner has unconstrained ability to call setAllowedToken(token, false) at any time

• There is no warning, timelock, or on-chain check preventing deletion while the AssetToken holds a nonzero balance

Impact:

• All LP depositors for that token permanently lose access to their underlying funds — the AssetToken contract still holds their tokens but the protocol no
  longer routes to it

• The impact scales with how much liquidity is deposited at the time of the call

Proof of Concept

function testSetAllowedTokenFalseLocksFunds() public {
vm.prank(thunderLoan.owner());
thunderLoan.setAllowedToken(tokenA, true);

  // LP deposits 10e18 tokenA                                                                                                                                  
  tokenA.mint(liquidityProvider, AMOUNT);                                                                                                                      
  vm.startPrank(liquidityProvider);                                                                                                                            
  tokenA.approve(address(thunderLoan), AMOUNT);                                                                                                                
  thunderLoan.deposit(tokenA, AMOUNT);
  vm.stopPrank();                                                                                                                                              
                                                        
  // Owner disables the token (e.g. security incident, token deprecation)                                                                                      
  vm.prank(thunderLoan.owner());
  thunderLoan.setAllowedToken(tokenA, false);                                                                                                                  
                                                        
  // LP attempts to redeem — permanently reverts                                                                                                               
  vm.startPrank(liquidityProvider);
  vm.expectRevert(                                                                                                                                             
      abi.encodeWithSelector(ThunderLoan.ThunderLoan__NotAllowedToken.selector, address(tokenA))
  );                                                                                                                                                           
  thunderLoan.redeem(tokenA, AMOUNT); // REVERTS forever — funds locked
  vm.stopPrank();                                                                                                                                              

}

Recommended Mitigation

Only allow deletion when the AssetToken holds no remaining balance. Otherwise, force the owner to wind down liquidity before disabling the token:

function setAllowedToken(IERC20 token, bool allowed) external onlyOwner returns (AssetToken) {
// ...
} else {
AssetToken assetToken = s_tokenToAssetToken[token];

•   if (token.balanceOf(address(assetToken)) > 0) {   
  

•       revert ThunderLoan__TokenHasExistingDeposits();                                                                                                      
  

•   }                                                                                                                                                        
    delete s_tokenToAssetToken[token];                                                                                                                       
    emit AllowedTokenSet(token, assetToken, allowed);                                                                                                        
    return assetToken;                                
  

  }
  }