Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Loan interest is wrongly compounded when the loan is bought

CircleLooper

Summary

Loan interest is wrongly compounded when the loan is bought by another lender.

Vulnerability Details

After a loan is created, the interest is a simple interest which is calculated on the principal.

function _calculateInterest(
Loan memory l
) internal view returns (uint256 interest, uint256 fees) {
uint256 timeElapsed = block.timestamp - l.startTimestamp;
interest = (l.interestRate * l.debt * timeElapsed) / 10000 / 365 days;
fees = (lenderFee * interest) / 10000;
interest -= fees;
}

However, if the loan is in auction and bought by another lender, the accumulated interest will be added to the loan's debt.

loans[loanId].debt = totalDebt;

Loan interest is wrongly compounded and borrower need to pay more interest as the principal is increased, which is not fair to the borrower.

Impact

Borrower need to pay more interest.

Tools Used

Manual Review

Recommendations

The interest should not be compounded when the loan is bought. Please consider to seperately account the accumulated interest and not to add the interest to the loan's debt.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.