Beedle - Oracle free perpetual lending

Summary

Vulnerability Details

The use of external calls in nested loops and subsequent loops, which iterate over lists that
could have been provided by callers, may result in an out-of-gas failure during execution.

There are 15 instances of this issue:

• IERC20(loan.loanToken).transfer(feeReceiver,fees) external calls in loop may result in DOS.

• IERC20(loan.loanToken).transfer(msg.sender,debt - fees) external calls in loop may result in DOS.

• IERC20(loan.collateralToken).transferFrom(msg.sender,address(this),collateral) external calls in loop may result in DOS.

• IERC20(loan.loanToken).transferFrom(msg.sender,address(this),loan.debt + lenderInterest) external calls in loop may result in DOS.

• IERC20(loan.loanToken).transferFrom(msg.sender,feeReceiver,protocolInterest) external calls in loop may result in DOS.

• IERC20(loan.collateralToken).transfer(loan.borrower,loan.collateral) external calls in loop may result in DOS.

• IERC20(loan.loanToken).transfer(feeReceiver,protocolInterest) external calls in loop may result in DOS.

• IERC20(loan.collateralToken).transfer(feeReceiver,govFee) external calls in loop may result in DOS.

• IERC20(loan.collateralToken).transfer(loan.lender,loan.collateral - govFee) external calls in loop may result in DOS.

• IERC20(loan.loanToken).transferFrom(msg.sender,address(this),debtToPay - debt) external calls in loop may result in DOS.

• IERC20(loan.loanToken).transfer(feeReceiver,fee) external calls in loop may result in DOS.

• IERC20(loan.loanToken).transfer(msg.sender,debt - debtToPay - fee) external calls in loop may result in DOS.

• IERC20(loan.loanToken).transfer(feeReceiver,protocolInterest) external calls in loop may result in DOS.

• IERC20(loan.collateralToken).transferFrom(msg.sender,address(this),collateral - loan.collateral) external calls in loop may result in DOS.

• IERC20(loan.collateralToken).transfer(msg.sender,loan.collateral - collateral) external calls in loop may result in DOS.

Impact

Tools Used

Recommendations

It is recommended to set the max length to which a for loop can iterate.
If possible, use pull over push strategy for external calls.