Beedle - Oracle free perpetual lending

Summary

The giveLoan() function of the Lending.sol contract is used to move a users loans to another pool by providing 2 arrays of Loan and Pool structs, whose lengths are left unchecked.

Vulnerability Details

The function takes in an array of the loan ids and the respective pools to move funds to, but the loop goes over the length of the loanIDs assuming their lengths are the same. The expectation is that the user submitting the function will ensure that the indexes of the arrays correspond to the correct values in the other arrays, and thus that the lengths will be the same. Common practice in such a situation is to verify that the lengths are equal to ensure the user hasn't made an error, since it is an external function.

Impact

Unexpected reverts, possible loan transfer to the wrong pool upon meeting the certain conditions defined in the function

Tools Used

Manual Review

Recommendations

Add an additional check before the loop to compare the lengths of the loanIds and poolIds