Beedle - Oracle free perpetual lending

Summary

Protocol implements Ownable contract that allows to set Lender contract owner and transfer owner with transferOwnership function

Vulnerability Details

Ownable is common implementation of contract's ownership, however, it has a shortcoming that it allows the owner to transfer ownership to a non-existent or mistyped address.

Impact

In this case, team will lose access to Governance functions of Lender.sol contract - setLenderFee, setBorrowerFee, setFeeReceiver` and thus won't be able to change these variables in case of necessity.

Tools Used

Observation

Recommendations

Use openzeppelin Ownable2Step contract. Ownable2Step is safer than Ownable for smart contracts because the owner cannot accidentally transfer smart contract ownership to a mistyped address. Rather than directly transferring to the new owner, the transfer only completes when the new owner accepts ownership.