Doubt in ThunderLoan::getCalculatedFee() return value.

[Yashwant23]

Hi, In ThunderLoan::getCalculatedFee first the amount is converted into weth equivalent of the token , in next step fee is calculated on weth amount and returned

    function getCalculatedFee(
        IERC20 token,
        uint256 amount
    ) public view returns (uint256 fee) {
        //slither-disable-next-line divide-before-multiply
        uint256 valueOfBorrowedToken = (amount *
            getPriceInWeth(address(token))) / s_feePrecision;
        //slither-disable-next-line divide-before-multiply
        // e fees is in weth
        fee = (valueOfBorrowedToken * s_flashLoanFee) / s_feePrecision;
    }

but the use of fee is done in such a way that it is treated as token equivalent.

in ThunderLoan::flashLoan

function flashloan(
        address receiverAddress,
        IERC20 token,
        uint256 amount,
        bytes calldata params
    ) external revertIfZero(amount) revertIfNotAllowedToken(token) {
        AssetToken assetToken = s_tokenToAssetToken[token];
        uint256 startingBalance = IERC20(token).balanceOf(address(assetToken));
..................
.................
        // @audit-info fee is in weth instead of the token , that will affect the Excahnge rate.
        uint256 fee = getCalculatedFee(token, amount);
        // slither-disable-next-line reentrancy-vulnerabilities-2 reentrancy-vulnerabilities-3
        assetToken.updateExchangeRate(fee);
 .................
.................

        uint256 endingBalance = token.balanceOf(address(assetToken));
        if (endingBalance < startingBalance + fee) {
            revert ThunderLoan__NotPaidBack(
                startingBalance + fee,
                endingBalance
            );
        }
       ....
    }

both endingBalance and startingBalance are amount of tokens but fee is weth equivalent.

similar to above case in AssetToken::updateExchangeRate

function updateExchangeRate(uint256 fee) external onlyThunderLoan {
        .................
        ................
        uint256 newExchangeRate = (s_exchangeRate * (totalSupply() + fee)) /
            totalSupply();

        if (newExchangeRate <= s_exchangeRate) {
            revert AssetToken__ExhangeRateCanOnlyIncrease(
                s_exchangeRate,
                newExchangeRate
            );
        }
        s_exchangeRate = newExchangeRate;
        emit ExchangeRateUpdated(s_exchangeRate);
    }

(totalSupply() + fee) are used for calculation of new exchangeRate but totalSupply() returns count of ERC20 in circulation but
fee is the same fee used in ThunderLoan::flashLoan (weth amount instead of token amount)

What i think is ThunderLoan::getCalculatedFee() must return fee after converting it into token equivalent

[EngrPips]

@Yashwant23, It seems like you figured it out.

[Yashwant23]

Not so clear, but in follow up videos patrick address it as it more of confusing part from developers requirement to get fees in weth instead of tokens , address it as audit-info.
And in tried codehawks audit report for first floghts , there was also no mention of it.

So I think , i should try to write some poc where token and weth conversion have large order discrepancy, before reopening this discussion tab.

[EngrPips]

Alright, Take your time.

[Yashwant23]

After writing the PoC , I understood that it is not breaking the protocol,
since the user is paying the fee so check in ThunderLoan::flashloan is passing and AssetToken::updateExchangeRate() is not breaking because user will pay the numerical equivalent of underlying tokens.

Now it is clear , how the fees is working in the protocol 😊.
Thanks.

[EngrPips]

Awesome, I am glad you figured it out.