Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Malicious lender can lend a loan with minimum auction length by front-running

CircleLooper

Summary

Malicious lender can lend a loan with minimum auction length by front-running.

Vulnerability Details

Pool auction length can be updated through setPool method by the lender.

function setPool(Pool calldata p) public returns (bytes32 poolId) {
// validate the pool
if (
p.lender != msg.sender ||
p.minLoanSize == 0 ||
p.maxLoanRatio == 0 ||
p.auctionLength == 0 ||
p.auctionLength > MAX_AUCTION_LENGTH ||
p.interestRate > MAX_INTEREST_RATE
) revert PoolConfig();
​
​
// check if they already have a pool balance
poolId = getPoolId(p.lender, p.loanToken, p.collateralToken);
​
​
// you can't change the outstanding loans
if (p.outstandingLoans != pools[poolId].outstandingLoans)
revert PoolConfig();
​
​
uint256 currentBalance = pools[poolId].poolBalance;
​
​
if (p.poolBalance > currentBalance) {
// if new balance > current balance then transfer the difference from the lender
IERC20(p.loanToken).transferFrom(
p.lender,
address(this),
p.poolBalance - currentBalance
);
} else if (p.poolBalance < currentBalance) {
// if new balance < current balance then transfer the difference back to the lender
IERC20(p.loanToken).transfer(
p.lender,
currentBalance - p.poolBalance
);
}
​
​
emit PoolBalanceUpdated(poolId, p.poolBalance);
​
​
if (pools[poolId].lender == address(0)) {
// if the pool doesn't exist then create it
emit PoolCreated(poolId, p);
} else {
// if the pool does exist then update it
emit PoolUpdated(poolId, p);
}
​
​
pools[poolId] = p;
}

A malicious lender can update the auction length to 1 by front-running a borrower, leading to the borrower taking a loan with minimum auction length.

Impact

Malicious lender can start an auction for the loan, the auction will end in a very short time (1 block), the loan can then be seized and borrower will lose collateral before realizing the problem.

Tools Used

Manual Review

Recommendations

Please consider to allowing borrower to specify auction length when borrows a loan.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.