Thunder Loan
AI First Flight #7
Beginner FriendlyFoundryDeFiOracle
EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Divide-before-multiply in `getCalculatedFee` zeroes the fee for low-priced tokens

codebycinar

Description

Normal behavior: the fee should be proportional to borrowed value for any allowed token.

Specific issue: getCalculatedFee computes valueOfBorrowedToken = amount * price / 1e18 and truncates BEFORE the bps multiply. For a low-priced token the intermediate collapses to 0, so even a large loan pays no fee (and then hits the zero-fee revert path). The slither-disable-next-line divide-before-multiply comment acknowledges but ships it.

uint256 valueOfBorrowedToken = (amount * getPriceInWeth(address(token))) / s_feePrecision; // @> truncates first
fee = (valueOfBorrowedToken * s_flashLoanFee) / s_feePrecision;

Risk

Likelihood:

  • Any allowed token with a low WETH price triggers systematic under-charging / zero fees.

Impact:

  • Under-collection of fees / DoS on those loans (via the zero-fee revert). Bounded, hence Low.

Proof of Concept

test/unit/OracleFeeExploit.t.sol, test_DivideBeforeMultiplyZeroesLargeLoanFee (PASSES): with price = 1e6, a 1e11-unit loan gives fee == 0.

Recommended Mitigation

Multiply before dividing.

- uint256 valueOfBorrowedToken = (amount * getPriceInWeth(address(token))) / s_feePrecision;
- fee = (valueOfBorrowedToken * s_flashLoanFee) / s_feePrecision;
+ fee = (amount * getPriceInWeth(address(token)) * s_flashLoanFee) / (s_feePrecision * s_feePrecision);
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[L-01] getCalculatedFee can be 0

## Description getCalculatedFee can be as low as 0 ## Vulnerability Details Any value up to 333 for "amount" can result in 0 fee based on calculation ``` function testFuzzGetCalculatedFee() public { AssetToken asset = thunderLoan.getAssetFromToken(tokenA); uint256 calculatedFee = thunderLoan.getCalculatedFee( tokenA, 333 ); assertEq(calculatedFee ,0); console.log(calculatedFee); } ``` ## Impact Low as this amount is really small ## Recommendations A minimum fee can be used to offset the calculation, though it is not that important.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!