Beedle - Oracle free perpetual lending

Summary

When the loan is given to another pool in buyLoan function, there is no check to ensure that the collateral ratio of the new pool is higher than the previous pool.

Vulnerability Details

In buyLoan function if collateral ratio of new pool is lower than previous pool, the collateral ratio of new pool will be bypassed .
Senario :
1 - attacker creates a pool with collateral ratio of 10000% and balance of 1000 loan token .
2 - he puts 10 collateral and borrows 1000 loan token from his own pool .
3 - he starts auction on the loan and calls buyLoan then transfers the loan to another pool with collateral ratio of 0.5 .
4 - eventually 1 collateral is transferred to new pool and 1000 loan token transferred from new pool to old pool to buy loan .
5 - so collateral ratio of new pool has been bypassed

Impact

Collateral ratio of pools can be bypassed

Tools Used

Manual Review

Recommendations

Check that collateral ratio of new pool isn't lower than previous pool .