Beedle - Oracle free perpetual lending

Summary

Rounding error risk in borrow() function in Lender.sol.

Affected line:

uint256 fees = (debt * borrowerFee) / 10000;

Since borrowerFee is currently set to 50, if the value of debt is <= 199, the computation will result in a rounding error

Vulnerability Details

PoC:

debt = 199
borrowerFee = 50

uint256 fees = (debt * borrowerFee) / 10000 = (199 * 50) / 10000 = 9950 / 10000 = 0.995 = 0 (in solidity without any proper handling of fractional values)

Impact

Zero fees.

RISK:

• feeReceiver wont receive the borrower fee

• borrower will receive the full debt amount, instead of (debt - fees) amount

Tools Used

VSC, manual.

Recommendations

• Import & use fixed-point arithmetic math libraries

• or implement fixed-point arithmetic (aka scaling factor) manually in each rounding error vulnerable statement