`refinance()` incorrectly updates `poolBalance`, which enables griefing of lenders
Summary
refinance function in Lender.sol mistakenly decreases pools[poolId].poolBalance twice; enables griefing of lenders
Vulnerability Details
Because refinance() mistakenly decreases pools[poolId].poolBalance twice (lines 636 and 698), an attacker can repeatedly refinance loans to a pool to decrease the poolBalance to zero. (Note that loans can be refinanced to the same pool.) The lender will be unable to withdraw those funds from the pool, and their pool will not be able to loan to borrowers. The funds become locked in the Lender.sol contract with no avenue for recovery.
Impact
Lender loses all their unlent funds, and those funds are no longer available to lend. User funds are directly at risk.
Tools Used
Recommendations
Delete lines 697-698 in Lender.sol
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.