Beedle - Oracle free perpetual lending

Summary

In Lender.giveloan() there is a missing check that the length of the two arrays passed as input should be equal. This could lead to unexpected results.

Vulnerability Details

In Lender.giveLoan() two arrays are passed as inputs , one is array of uint256 (loanIds) and the other is array of bytes32 (poolIds). The assumption here is that the user who is calling the function will ensure that the indexes of the loanIds array correspond to the correct values in the poolIds array, hence the lengths will be the same. However this is not necessarily the case.

Impact

If loaNIds array is shorter than the poolIds array, then the additional values in the longer array will be ignored.This could lead to unexpected results.

Tools Used

Manual Review

Recommendations

Consider adding the following check in Lender.giveLoan():
if(loanIds.length != poolIds.length) revert MissmatchingArrayLenghts();

Please note that I wrote the above statement with a custom error which is not declared in Errors.sol