Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Thunder Loan
Submissions
AI First Flight
Thunder Loan
AI First Flight #7
Beginner Friendly
Foundry
DeFi
Oracle
EXP
AI First Flight
EXP
Sep 16th, 2026 → Sep 16th, 2026
View repo
View results
10 / 10
Submissions
Severity
Validity
Tags
Author
#1
Malicious flash-loan receiver calls deposit() instead of repay() to steal the borrowed principal as redeemable LP shares
High
Valid
[H-04] All the funds can be...
comphygxp
#2
deposit() charges a phantom fee on plain deposits with no matching inflow, inflating exchangeRate and causing later LPs to lose funds
High
Valid
[H-02] Updating exchange ra...
comphygxp
#3
setAllowedToken(token, false) followed by re-enabling permanently strands existing LPs' deposited funds in an orphaned AssetToken
Medium
Valid
[M-01] 'ThunderLoan::setAll...
comphygxp
#4
UUPS upgrade to ThunderLoanUpgraded silently corrupts the flash-loan fee from 0.3% to 100% via a storage slot collision
High
Valid
[H-01] Storage Collision du...
comphygxp
#5
Nested same-token flashloan wipes the shared s_currentlyFlashLoaning flag, causing the outer loan's honest repay() to revert
Low
Invalid
comphygxp
#6
OracleUpgradeable trusts the raw TSwap spot price with no TWAP/deviation protection, letting an attacker manipulate the flashloan fee atomically
High
Invalid
comphygxp
#7
getCalculatedFee() uses a WETH-denominated value as a token-quantity fee, silently breaking the documented 0.3% rate for any non-1:1-priced token
Medium
Invalid
comphygxp
#8
getCalculatedFee() performs two sequential floor divisions instead of one, structurally undercharging LP flash-loan fees
Low
Valid
[L-03] Mathematic Operation...
comphygxp
#9
updateExchangeRate()'s strict <= guard rejects a legitimate zero-growth rate, making flashloan() revert for any dust-sized borrow amount
Low
Invalid
comphygxp
#10
redeem()'s revertIfZero modifier checks the raw type(uint256).max sentinel before it's remapped, letting a zero-balance max-redeem silently no-op instead of reverting
Low
Invalid
comphygxp
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
