Beedle - Oracle free perpetual lending

Summary

CEI violation, this entire block & state change should be placed before the external calls/transfers are made.

Vulnerability Details

n/a

Impact

not sure.

Tools Used

VSC, manual.

Recommendations

function setPool(Pool calldata p) public returns (bytes32 poolId) {
    // validate the pool
    if (
        p.lender != msg.sender ||
        p.minLoanSize == 0 ||
        p.maxLoanRatio == 0 ||
        p.auctionLength == 0 ||
        p.auctionLength > MAX_AUCTION_LENGTH ||
        p.interestRate > MAX_INTEREST_RATE
    ) revert PoolConfig();  /// @audit checked, OK.

    // check if they already have a pool balance
    poolId = getPoolId(p.lender, p.loanToken, p.collateralToken);

    // you can't change the outstanding loans
    if (p.outstandingLoans != pools[poolId].outstandingLoans)
        revert PoolConfig();

    uint256 currentBalance = pools[poolId].poolBalance;

    if (pools[poolId].lender == address(0)) {
        // if the pool doesn't exist then create it
        emit PoolCreated(poolId, p);
    } else {
        // if the pool does exist then update it
        emit PoolUpdated(poolId, p);
    }

    pools[poolId] = p;
    
    if (p.poolBalance > currentBalance) {
        // if new balance > current balance then transfer the difference from the lender
        IERC20(p.loanToken).transferFrom(
            p.lender,
            address(this),
            p.poolBalance - currentBalance
        );
    } else if (p.poolBalance < currentBalance) {
        // if new balance < current balance then transfer the difference back to the lender
        IERC20(p.loanToken).transfer(   
            p.lender,
            currentBalance - p.poolBalance
        );
    }

    emit PoolBalanceUpdated(poolId, p.poolBalance);
}