Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium

Loan auction deadline checks are inconsistent, resulting in the ability to seize loans while they can still be bought

bernd

Summary

The auction deadline comparison in the buyLoan and seizeLoan functions overlaps, allowing seizing loans while they can still be bought.

Vulnerability Details

An auctioned loan can be bought as long as the auction deadline is not reached. The buyLoan function determines the auction end as loan.auctionStartTimestamp + loan.auctionLength in line 471. If the current block.timestamp is less than or equal to the auction end, the loan can be bought.

Conversely, the seizeLoan allows seizing the loan if the current block.timestamp is equal or greater than the auction end. This comparison overlaps with the buyLoan function and allows seizing loans while they can still be bought.

Lender.sol#L471

465: function buyLoan(uint256 loanId, bytes32 poolId) public {
466: // get the loan info
467: Loan memory loan = loans[loanId];
468: // validate the loan
469: if (loan.auctionStartTimestamp == type(uint256).max)
470: revert AuctionNotStarted();
471: if (block.timestamp > loan.auctionStartTimestamp + loan.auctionLength) // @audit-info inconsistent comparison operator
472: revert AuctionEnded();
...: // [...]

Lender.sol#L556-L559

548: function seizeLoan(uint256[] calldata loanIds) public {
549: for (uint256 i = 0; i < loanIds.length; i++) {
550: uint256 loanId = loanIds[i];
551: // get the loan info
552: Loan memory loan = loans[loanId];
553: // validate the loan
554: if (loan.auctionStartTimestamp == type(uint256).max)
555: revert AuctionNotStarted();
556: if (
557: block.timestamp <
558: loan.auctionStartTimestamp + loan.auctionLength // @audit-info inconsistent comparison operator
559: ) revert AuctionNotEnded();
...: // [...]
585: }
586: }

Impact

Loans can be seized while they can still be bought.

Tools Used

Manual Review

Recommendations

Consider using <= instead of <.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!