Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Thunder Loan
Submissions
AI First Flight
Thunder Loan
AI First Flight #7
Beginner Friendly
Foundry
DeFi
Oracle
EXP
AI First Flight
EXP
Jul 25th, 2026 → Jul 25th, 2026
View repo
View results
9 / 9
Submissions
Severity
Validity
Tags
Author
#1
A flash loan can be settled with `deposit` instead of `repay`, so the borrower keeps a redeemable claim on the money they just returned and walks away with the entire pool
High
Valid
[H-04] All the funds can be...
augustwh11
#2
`deposit` credits the deposit itself as fee revenue, so the protocol is insolvent from the very first deposit and liquidity providers who exit first take the shortfall out of those who exit last
High
Valid
[H-02] Updating exchange ra...
augustwh11
#3
`ThunderLoanUpgraded` reorders storage, so after the upgrade `s_flashLoanFee` reads the old `s_feePrecision` slot and every flash loan is charged a 100% fee
High
Valid
[H-01] Storage Collision du...
augustwh11
#4
`flashloan` has no re-entrancy protection, so nesting it credits the exchange rate with one fee per level while only a single fee is ever paid — 140 credits for one fee in a single transaction, and the whole pool in twenty-one
High
Invalid
augustwh11
#5
`AssetToken::updateExchangeRate` adds an underlying-denominated fee to a share-denominated total supply, over-crediting every fee once the rate leaves 1.0 — the protocol becomes insolvent through entirely honest use
Medium
Invalid
augustwh11
#6
The flash-loan fee is a WETH-denominated value charged in units of the borrowed token, so every token cheaper than ETH is under-charged in proportion to its price — USDC pays 1.5 instead of 3,000 on a 1,000,000 loan
High
Invalid
augustwh11
#7
he flash-loan fee is priced off an instantaneous TSwap spot price, so an attacker can front-run a borrower and set the fee that borrower pays — 99.7x the correct amount in the measured run
Medium
Valid
[M-02] Attacker can minimiz...
augustwh11
#8
`deposit` mints shares for the requested amount without measuring what arrived, so STA — a token the README lists as supported — leaves the pool under-collateralised, and flash loans of it are impossible entirely
Medium
Valid
[M-03] `ThunderLoan:: depos...
augustwh11
#9
`setAllowedToken(token, false)` orphans the AssetToken holding every liquidity provider's deposit, and no function in either implementation can reach those funds again
Medium
Valid
[M-01] 'ThunderLoan::setAll...
augustwh11
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
