Submission Details
Severity:
Pool owner can front-run loans to snap extra fee
Summary
Pool owner can front-run borrower to snap extra fees
Vulnerability Details
Lender.sol allows pool owners to update [pool loan interest rate](Pool owner can front-run loans to snap extra fee) at will. A malicious pool owner can sandwich-attack a lucrative loan to snap extra fees.
Impact
Borrower is charged more than expected interest rate.
Tools Used
Manual review
Recommendations
Add a uint256 maximumInterestRate input parameter to function borrow and check that the pool interest rate is not more than this value.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.