Beedle - Oracle free perpetual lending

Summary

Vulnerability Details

Calls inside a loop might lead to a denial-of-service attack.

There are 4 instances of this issue:

• Lender.borrow(Borrow[]) has external calls inside a loop: IERC20(loan.loanToken).transfer(feeReceiver,fees)

• Lender.borrow(Borrow[]) has external calls inside a loop: IERC20(loan.collateralToken).transferFrom(msg.sender,address(this),collateral)

• Lender.borrow(Borrow[]) has external calls inside a loop: IERC20(loan.loanToken).transfer(msg.sender,debt - fees)

• Lender.repay(uint256[]) has external calls inside a loop: IERC20(loan.collateralToken).transfer(loan.borrower,loan.collateral)

• Lender.repay(uint256[]) has external calls inside a loop: IERC20(loan.loanToken).transferFrom(msg.sender,address(this),loan.debt + lenderInterest)

• Lender.repay(uint256[]) has external calls inside a loop: IERC20(loan.loanToken).transferFrom(msg.sender,feeReceiver,protocolInterest)

• Lender.giveLoan(uint256[],bytes32[]) has external calls inside a loop: IERC20(loan.loanToken).transfer(feeReceiver,protocolInterest)

• Lender.seizeLoan(uint256[]) has external calls inside a loop: IERC20(loan.collateralToken).transfer(feeReceiver,govFee)

• Lender.seizeLoan(uint256[]) has external calls inside a loop: IERC20(loan.collateralToken).transfer(loan.lender,loan.collateral - govFee)

• Lender.refinance(Refinance[]) has external calls inside a loop: IERC20(loan.collateralToken).transfer(msg.sender,loan.collateral - collateral)

• Lender.refinance(Refinance[]) has external calls inside a loop: IERC20(loan.loanToken).transfer(feeReceiver,fee)

• Lender.refinance(Refinance[]) has external calls inside a loop: IERC20(loan.loanToken).transfer(msg.sender,debt - debtToPay - fee)

• Lender.refinance(Refinance[]) has external calls inside a loop: IERC20(loan.collateralToken).transferFrom(msg.sender,address(this),collateral - loan.collateral)

• Lender.refinance(Refinance[]) has external calls inside a loop: IERC20(loan.loanToken).transferFrom(msg.sender,address(this),debtToPay - debt)

• Lender.refinance(Refinance[]) has external calls inside a loop: IERC20(loan.loanToken).transfer(feeReceiver,protocolInterest)

Exploit scenario

If one of the destinations has a fallback function that reverts, bad will always revert.

Impact

Tools Used

Recommendations

Favor pull over push strategy for external calls.