Beedle - Oracle free perpetual lending

Summary

Zero address check is missing, as well as check to ensure given address is not the Lender.sol or any other protocol contract's instance.

Vulnerability Details

n/a

Impact

Risk/Damage/Threat:

• Fees will be lost if sent to zero address.

• If sent to any protocol contract accidentally/intentionally by rogue onlyOwner, then added fees could mess with expected/valid contract state, and potentially enable currently impossible attack vectors.

Tools Used

VSC, manual

Recommendations

either use require() statement or if statement with custom error for revert(for gas optimization).

function setFeeReceiver(address _feeReceiver) external onlyOwner {
		require(_feeReceiver != address(0));
		/// and maybe an if statement block here to ensure _feeReceiver cannot be any protocol contract addresses
    feeReceiver = _feeReceiver;
}