Beedle - Oracle free perpetual lending

Summary

In buyLoan function anyone can buy the loan and become lender without having a pool .

Vulnerability Details

When the lender starts an auction for a loan then anyone can call buyLoan to buy the auctioned loan. the new lender passes a poolId as the new pool to move the loan to. The problem is that buyLoan does not check for the msg.sender to see if he is the lender of the poolId. He can pass any arbitrary poolId that he does not own, eventually at the end of buyLoan msg.sender is set as the new pool's token.

Impact

Anyone can become the pool's lender of the poolId they pass in the buyLoan and own the pool.

Tools Used

Manual Review

Recommendations

Add a check to ensure the poolId lender is msg.sender.