Beedle - Oracle free perpetual lending

Summary

Multiple functions may fail due to iteration over an unbounded loop.

Vulnerability Details

The borrow, repay, giveLoan, startAuction, seizeLoan and refinance functions all iterate over an unbounded loop, with arbitrary size, received an input. Since these functions perform multiple external calls each iteration, the block gas limit may be exceeded if the amount of iterations is big enough to cause the transaction to fail.

Impact

Users stand to lose a substantial amount of gas fees provided with their transaction, which ultimately will fail. This situation can lead to financial losses, and a diminished level of trust in the protocol's reliability.

Tools Used

Manual Review, Solodit.

Recommendations

Limit the number of loop iterations to the max number of operations a user can do in bulk on a single transaction.