Beedle - Oracle free perpetual lending

Summary

No check is performed to confirm that the new _owner address is a valid (non-zero) address.

Vulnerability Details

If the owner calls the transferOwnership function and for some odd reason the new _owner address is not valid. Ownership can be transferred into a dead or most likely in this case a zero address as there are no checks for that in the codepiece.

Impact

A loss of ownership and of funds.

Tools Used

Manual code review

Recommendations

A require or a revert statement should be added to make sure the address is valid.
e.g require(_owner != address(0), "New owner is the zero address");