Beedle - Oracle free perpetual lending

Summary

Vulnerability Details

Even if the function follows the best practice of check-effects-interaction,
not using a reentrancy guard when there may be transfer hooks will open the
users of this protocol up to
read-only reentrancies
with no way to protect against it, except by block-listing the whole protocol.

There are 20 instances of this issue:

• IERC20(p.loanToken).transferFrom(p.lender,address(this),p.poolBalance - currentBalance) should use Reentrancy-Guard.

• IERC20(p.loanToken).transfer(p.lender,currentBalance - p.poolBalance) should use Reentrancy-Guard.

• IERC20(pools[poolId].loanToken).transferFrom(msg.sender,address(this),amount) should use Reentrancy-Guard.

• IERC20(pools[poolId].loanToken).transfer(msg.sender,amount) should use Reentrancy-Guard.

• IERC20(loan.loanToken).transfer(feeReceiver,fees) should use Reentrancy-Guard.

• IERC20(loan.loanToken).transfer(msg.sender,debt - fees) should use Reentrancy-Guard.

• IERC20(loan.collateralToken).transferFrom(msg.sender,address(this),collateral) should use Reentrancy-Guard.

• IERC20(loan.loanToken).transferFrom(msg.sender,address(this),loan.debt + lenderInterest) should use Reentrancy-Guard.

• IERC20(loan.loanToken).transferFrom(msg.sender,feeReceiver,protocolInterest) should use Reentrancy-Guard.

• IERC20(loan.collateralToken).transfer(loan.borrower,loan.collateral) should use Reentrancy-Guard.

• IERC20(loan.loanToken).transfer(feeReceiver,protocolInterest) should use Reentrancy-Guard.

• IERC20(loan.loanToken).transfer(feeReceiver,protocolInterest) should use Reentrancy-Guard.

• IERC20(loan.collateralToken).transfer(feeReceiver,govFee) should use Reentrancy-Guard.

• IERC20(loan.collateralToken).transfer(loan.lender,loan.collateral - govFee) should use Reentrancy-Guard.

• IERC20(loan.loanToken).transferFrom(msg.sender,address(this),debtToPay - debt) should use Reentrancy-Guard.

• IERC20(loan.loanToken).transfer(feeReceiver,fee) should use Reentrancy-Guard.

• IERC20(loan.loanToken).transfer(msg.sender,debt - debtToPay - fee) should use Reentrancy-Guard.

• IERC20(loan.loanToken).transfer(feeReceiver,protocolInterest) should use Reentrancy-Guard.

• IERC20(loan.collateralToken).transferFrom(msg.sender,address(this),collateral - loan.collateral) should use Reentrancy-Guard.

• IERC20(loan.collateralToken).transfer(msg.sender,loan.collateral - collateral) should use Reentrancy-Guard.

Impact

Tools Used

Recommendations

Using Reentrancy-Guard
when calling contracts/addresses with transfer hooks.