Beedle - Oracle free perpetual lending

Summary

The transferFrom function does not check if the msg.sender is the same as the lender, which means that anyone can call this function and move funds that belong to the lender. To prevent this, you should add a require statement that checks if the msg.sender is equal to the lender before calling the transferFrom function.

Vulnerability Details

In Lender.sol =>
Before transferFrom function, add this below code snippet =>
// check if msg.sender is the lender
if (msg.sender != p.lender) {
revert("Only the lender can transfer funds");
}

Impact

If you do not check msg.sender == p.lender, This will happen => anyone can call this function and move funds that belong to the lender. This could result in a loss of funds for the lender or an unintended transfer of tokens to the pool.

Tools Used

Olympix

Recommendations