Thunder Loan

The flashloan check uses token.balanceOf which is manipulated by deposit.

Root: flashloan() validates repayment with endingBalance = token.balanceOf(assetToken). But deposit() also increases that balance and mints AssetTokens.

Attack:

1. Attacker flashloans 1000 tokens

2. In callback, calls deposit(token, 1000+fee) -> passes balance check + gets AssetTokens

3. Calls redeem() to drain all LPs funds

Impact: High - total loss of protocol

Likelihood: High - easy to exploit

Fix: block deposit during flashloan

if (s_currentlyFlashLoaning[token]) revert;