Beedle - Oracle free perpetual lending

Summary

The Lender#borrow and Lender#refinance functions in the provided lending protocol may be susceptible to errors due to incorrect loan ratios. This is primarily caused by a mismatch in the decimals of debt and collateral tokens.

Vulnerability Details

In the code snippet:

The function assumes that both the debt and collateral values use 18 decimals, which is common for many ERC-20 tokens. However, not all tokens use 18 decimals. Some may use fewer, like 6 (USDC, for instance) or more.

If either the debt or collateral tokens were to use a decimal value other than 18, this calculation could yield an incorrect loan ratio. This means that a user might be able to borrow more or less than they should be able to based on their provided collateral.

Impact

• Borrowers: They might be able to borrow amounts that are disproportionate to their collateral. This could allow them to exploit the system to their advantage, leading to potential losses for lenders.

• Lenders: Lenders are at risk as they might end up lending out more funds than they should relative to the received collateral. This means that if a borrower defaults, the collateral may not be sufficient to cover the lender's losses.

Tools Used

Manual review.

Recommendations

Dynamic Decimal Handling: Modify the calculation to take into account the actual decimal values of both the debt and collateral tokens. This can be achieved by fetching the decimals() function from the respective ERC-20 contracts, and then using that to adjust the calculation.