Beedle - Oracle free perpetual lending

Summary

The loan’s auctionLength does not update.

Vulnerability Details

The lender uses giveLoan() function to give his loans to another pool. In the giveLoan() function, various requirements are checked before proceeding to update the state at the end**.**

When a lender give his loan to another pool, the loan’s states are newly saved because the loan needs to follow the settings of the pool that it's being given to. However, the auctionLength of the pool is not updated even if it's different. The auctionLength of the loans in the pool is not kept constant, which could cause problems for lenders if an auction is to take place later on.

This also happens in buyLoan() function.

Impact

Inconsistency of pool and potential issues in future auctions.

Tools Used

vscode

Recommendations

add this line at the end of for loop.