Beedle - Oracle free perpetual lending

Summary

Irrelevant values are used in the calculation of interest leading to wrong values being derived.

Vulnerability Details

In Structs.sol according to the comment, loan.interest is the interest rate of the loan per second (in debt tokens). Note the word second

In _calculateInterest() interest is gotten by multiplying the interest rate, the debt and the time elapsed then dividing by 10000 and further division by 365.
The issue here results in the fact that the interest rate is supplied in terms of loan per second
so there is no need for further division by 365 days as the interest rate multiplied by the debt and time elapsed divided by 10000 is enough.

Impact

Wrong values for interest will be calculated and used throughout the protocol resulting in loss of funds.

Tools Used

Manual Review

Recommendations

Calculations for the interest should be reevaluated and adjusted to fit the interestRate in per seconds.