Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Thunder Loan
Submissions
AI First Flight
Thunder Loan
AI First Flight #7
Beginner Friendly
Foundry
DeFi
Oracle
EXP
AI First Flight
EXP
Nov 2nd, 2026 → Nov 9th, 2026
View repo
View results
4 / 4
Submissions
Severity
Validity
Tags
Author
#1
Flash loan can be "repaid" via `deposit()`, letting the borrower keep the principal as redeemable AssetTokens and drain the pool
High
Valid
[H-04] All the funds can be...
junzai
#2
`deposit()` books a flash-loan fee that nobody paid into the exchange rate, so depositors can instantly redeem more than they deposited and drain other LPs
High
Valid
[H-02] Updating exchange ra...
junzai
#3
Upgrade to `ThunderLoanUpgraded` shifts the storage layout so `s_flashLoanFee` reads the old `s_feePrecision` slot (1e18) — every flash loan is charged a 100% fee and the protocol breaks on upgrade
High
Valid
[H-01] Storage Collision du...
junzai
#4
Flash-loan fee is priced off the TSwap pool's manipulable spot price with no TWAP or deviation guard, letting an attacker cut the fee 100x before borrowing
Medium
Valid
[M-02] Attacker can minimiz...
junzai
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
