Submission Details
Severity:
`buyLoan` should not be callable by anyone. It allows moving of bad loans away to other pools.
Summary
buyLoan should not be callable by anyone. It allows moving of bad loans away to other pools.
Vulnerability Details
If I own a pool, and I get too many bad loans in the pool, like with bad rates, or bad borrower, then I can just start an auction on those loans, and accept it on behalf of any pool owner. That is, transfer bad loans to other pools without the explicit approval of the pool owners.
File: src/Lender.sol
465: function buyLoan(uint256 loanId, bytes32 poolId) public {
Link to code - https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L465
Tools Used
Code Review
Recommendations
Add a check in buyLoan so that only the pool owner can accept the loan.
Auditor
NeoCrao
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.