Beedle - Oracle free perpetual lending

Summary

Any Person can be able to create a pool. But the check for the address Zero is not done in the setPool function that let anybody to create a pool by passing collateralToken address as Zero address.
This new pool now is not able to give loan to anybody and will always revert.

Vulnerability Details

No check for address Zero is done in setPool() in the Lender.sol contract. Anybody can create a pool with the collateral token set to address zero.


Proof of concept: test

To solve the problem, the lender would require to call the setPool funciton with correct data.

Impact

Nobody would be able to take loans from the pool.

Tools Used

Foundry tests.

Recommendations

In order to prevent this from happening check if the collateral token in not equal to zero in the setPool function.