Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Thunder Loan
Submissions
AI First Flight
Thunder Loan
AI First Flight #7
Beginner Friendly
Foundry
DeFi
Oracle
EXP
AI First Flight
EXP
Oct 5th, 2026 → Oct 5th, 2026
View repo
View results
7 / 7
Submissions
Severity
Validity
Tags
Author
#1
Flash-loan fees are less for non-standard ERC20 tokens: `getCalculatedFee` ignores token decimals (fixed 1e18)
High
Valid
[H-03] fee are less for non...
hopeh
#2
`ThunderLoan::deposit` is not compatible with fee-on-transfer tokens and can be exploited to drain other users' funds
Medium
Valid
[M-03] `ThunderLoan:: depos...
hopeh
#3
`ThunderLoan::deposit` wrongly calls `updateExchangeRate`, inflating the rate on deposits and breaking redemption
High
Valid
[H-02] Updating exchange ra...
hopeh
#4
Flash loan can be repaid via `deposit` instead of `repay`, letting an attacker mint AssetTokens and redeem to drain funds
High
Valid
[H-04] All the funds can be...
hopeh
#5
Storage collision during upgrade: `ThunderLoanUpgraded` reorders `s_feePrecision`/`s_flashLoanFee`, corrupting fee state
High
Valid
[H-01] Storage Collision du...
hopeh
#6
Attacker can minimize the `ThunderLoan::flashloan` fee via TSwap spot-price oracle manipulation
Medium
Valid
[M-02] Attacker can minimiz...
hopeh
#7
`ThunderLoan::setAllowedToken` can permanently lock liquidity providers out from redeeming their tokens
Medium
Valid
[M-01] 'ThunderLoan::setAll...
hopeh
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
