Submission Details
Severity:
`refinance()` decreases the pool balance twice.
Summary
During the refinance, it decreases the pool balance wrongly.
Vulnerability Details
Borrowers can refinance their loans using refinance().
File: 2023-07-beedle\src\Lender.sol
591: function refinance(Refinance[] calldata refinances) public {
...
635: // now lets deduct our tokens from the new pool
636: _updatePoolBalance(poolId, pools[poolId].poolBalance - debt); //@audit update balance
637: pools[poolId].outstandingLoans += debt;
638:
...
697: // update pool balance
698: pools[poolId].poolBalance -= debt; //@audit update again
But it updates the pool balance twice at L636 and L698 wrongly. As a result, the pool owner will lose funds unexpectedly.
Impact
Lenders would lose their funds as it tracks the pool balance wrongly.
Tools Used
Manual Review
Recommendations
We should remove this line.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.