Beedle - Oracle free perpetual lending

Summary

Loan can be bought by any user even if the user doesn't have any pool.

Vulnerability Details

When a loan goes for auction, any user to buy the loan through buyLoan method.

However, this method doesn't check if the buyer is lender of the pool, it simply reduced the pool balance and set the loan.lender to the caller.

It basically means any user can buy a loan even if the user doesn't have a pool.

Impact

User can get a loan without paying off debt and the real pool lender will lose funds.

Tools Used

Manual Review

Recommendations

If the caller is not the pool lender, transaction should revert.