Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Lenders can increase loan rate, forcing borrowers into bigger debts

Bauer

Summary

Lenders can increase loan rate, forcing borrowers into bigger debts

Vulnerability Details

The refinance function is designed to manage the refinancing of existing loans. It processes an array of refinancing requests and handles the complex logic of transferring debts, updating collateral, calculating interest, validating conditions, and updating the system state accordingly.
A lender can exploit the function by observing pending refinance() transactions and reacting in a manner that is detrimental to the borrowers.
Before a user calls the refinance() function, a lender can execute an updateInterestRate() function. By strategically setting the interest rate as high as possible, the lender could force borrowers into bigger debts.

​
loans[loanId].collateral = collateral;
// update loan interest rate
loans[loanId].interestRate = pool.interestRate;
// update loan start timestamp
loans[loanId].startTimestamp = block.timestamp;
// update loan auction start timestamp
loans[loanId].auctionStartTimestamp = type(uint256).max;
// update loan auction length
loans[loanId].auctionLength = pool.auctionLength;
// update loan lender
loans[loanId].lender = pool.lender;
// update pool balance
pools[poolId].poolBalance -= debt;
​
function updateInterestRate(bytes32 poolId, uint256 interestRate) external {
if (pools[poolId].lender != msg.sender) revert Unauthorized();
if (interestRate > MAX_INTEREST_RATE) revert PoolConfig();
pools[poolId].interestRate = interestRate;
emit PoolInterestRateUpdated(poolId, interestRate);
}

Impact

Borrowers can be forced to repay higher amounts than they expected when they were taking loans. If borrowers don't repay their increased debts, their collateral are seized by lenders.

Tools Used

Vscode

Recommendations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.