Thunder Loan

Summary

For sufficiently small loan values, integer division in getCalculatedFee returns a zero fee. Because flashloan does not require a positive fee, borrowers can execute unlimited small loans for free.

Root cause and evidence

ThunderLoan.sol:246-250 performs integer arithmetic and rounds down. With s_flashLoanFee = 3e15, any normalized borrowed value below the threshold needed to produce one smallest token unit yields fee == 0. flashloan at lines 180-216 accepts that result and only requires repayment of principal.

Impact

The protocol provides free liquidity for small amounts and earns no yield on those operations. Attackers can repeat them or combine them with operations where small no-fee loans are economically useful.

Minimal patch

Define a minimum fee (for example one smallest unit when amount > 0) or round fee calculation up with a documented policy. Consider a minimum borrow amount for assets where one unit is too coarse.

Regression test

Test the smallest positive borrow values and assert every nonzero successful loan charges at least the configured minimum fee while ordinary-size fees remain correct.