Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Thunder Loan
Submissions
AI First Flight
Thunder Loan
AI First Flight #7
Beginner Friendly
Foundry
DeFi
Oracle
EXP
AI First Flight
EXP
Oct 25th, 2026 → Oct 25th, 2026
View repo
View results
7 / 7
Submissions
Severity
Validity
Tags
Author
#1
Flashloan repaid via deposit(): balance check allows borrower to keep the loan as redeemable shares
High
Invalid
viaaiautomation
#2
deposit() mints shares against requested amount, not received amount, causing immediate insolvency with fee-on-transfer tokens
High
Invalid
viaaiautomation
#3
Attacker can actively drain existing LP funds via a deposit/redeem loop using fee-on-transfer tokens
Medium
Invalid
viaaiautomation
#4
setAllowedToken(false) deletes the asset mapping while LPs still hold shares, permanently locking their funds
Medium
Invalid
viaaiautomation
#5
Flashloan fee relies on AMM spot price, allowing attackers to suppress the fee via same-transaction manipulation
Medium
Invalid
viaaiautomation
#6
Upgrade to ThunderLoanUpgraded causes storage collision, corrupting the flashloan fee from 0.3% to 100%
High
Invalid
viaaiautomation
#7
deposit() inflates exchange rate without backing, causing all redeem() calls to revert permanently
High
Invalid
viaaiautomation
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
