Beedle - Oracle free perpetual lending

Summary

Vulnerability Details

According to the fact that EIP-20 states that zero-valued transfers must be accepted.

Checking non-zero transfer values can avoid an expensive external call and save gas.
While this is done at some places, it’s not consistently done in the solution.

There are 21 instances of this issue:

• Adding a non-zero-value check for TKN.transferFrom(msg.sender,address(this),_amount) at the beginning of Staking.deposit(uint256)

• Adding a non-zero-value check for IERC20(WETH).transfer(staking,IERC20(WETH).balanceOf(address(this))) at the beginning of Fees.sellProfits(address)

• Adding a non-zero-value check for TKN.transfer(msg.sender,_amount) at the beginning of Staking.withdraw(uint256)

• Adding a non-zero-value check for WETH.transfer(msg.sender,claimable[msg.sender]) at the beginning of Staking.claim()

• Adding a non-zero-value check for IERC20(p.loanToken).transferFrom(p.lender,address(this),p.poolBalance - currentBalance) at the beginning of Lender.setPool(Pool)

• Adding a non-zero-value check for IERC20(p.loanToken).transfer(p.lender,currentBalance - p.poolBalance) at the beginning of Lender.setPool(Pool)

• Adding a non-zero-value check for IERC20(loan.loanToken).transfer(feeReceiver,fees) at the beginning of Lender.borrow(Borrow[])

• Adding a non-zero-value check for IERC20(loan.loanToken).transfer(msg.sender,debt - fees) at the beginning of Lender.borrow(Borrow[])

• Adding a non-zero-value check for IERC20(loan.loanToken).transferFrom(msg.sender,address(this),loan.debt + lenderInterest) at the beginning of Lender.repay(uint256[])

• Adding a non-zero-value check for IERC20(loan.loanToken).transferFrom(msg.sender,feeReceiver,protocolInterest) at the beginning of Lender.repay(uint256[])

• Adding a non-zero-value check for IERC20(loan.collateralToken).transfer(loan.borrower,loan.collateral) at the beginning of Lender.repay(uint256[])

• Adding a non-zero-value check for IERC20(loan.loanToken).transfer(feeReceiver,protocolInterest) at the beginning of Lender.giveLoan(uint256[],bytes32[])

• Adding a non-zero-value check for IERC20(loan.loanToken).transfer(feeReceiver,protocolInterest) at the beginning of Lender.buyLoan(uint256,bytes32)

• Adding a non-zero-value check for IERC20(loan.collateralToken).transfer(feeReceiver,govFee) at the beginning of Lender.seizeLoan(uint256[])

• Adding a non-zero-value check for IERC20(loan.collateralToken).transfer(loan.lender,loan.collateral - govFee) at the beginning of Lender.seizeLoan(uint256[])

• Adding a non-zero-value check for IERC20(loan.loanToken).transferFrom(msg.sender,address(this),debtToPay - debt) at the beginning of Lender.refinance(Refinance[])

• Adding a non-zero-value check for IERC20(loan.loanToken).transfer(feeReceiver,fee) at the beginning of Lender.refinance(Refinance[])

• Adding a non-zero-value check for IERC20(loan.loanToken).transfer(msg.sender,debt - debtToPay - fee) at the beginning of Lender.refinance(Refinance[])

• Adding a non-zero-value check for IERC20(loan.loanToken).transfer(feeReceiver,protocolInterest) at the beginning of Lender.refinance(Refinance[])

• Adding a non-zero-value check for IERC20(loan.collateralToken).transferFrom(msg.sender,address(this),collateral - loan.collateral) at the beginning of Lender.refinance(Refinance[])

• Adding a non-zero-value check for IERC20(loan.collateralToken).transfer(msg.sender,loan.collateral - collateral) at the beginning of Lender.refinance(Refinance[])

Impact

Tools Used

Recommendations

Consider adding a non-zero-value check at the beginning of function.