Beedle - Oracle free perpetual lending

Summary

updateInterestRate function within the Lender.sol contract allows lender to change interest rate for all new loans made from the pool.

Vulnerability Details

Malicious lender may scan mempool and if new borrow tx appears, front-run it with setting higher interest rate.

Impact

It is borrower duty to check if this happened and close loan as soon is possible. However, as the max interest rate capped to 1000%, even 1 day of such a loan will lead to almost 3% loss for borrower.

Tools Used

Observation

Recommendations

Consider adding timelock for interest rate change. For example, allow lenders to make changes in the next block