Beedle - Oracle free perpetual lending

Summary

When transferring loan tokens in Lender.sol#addToPool(), a pool owner (lender) might end up having more loan tokens on paper than what they've actually deposited.

Vulnerability Details

Some ERC20 tokens do not revert on failure in transfer calls (reference). The addToPool() function in Lender.sol is susceptible to the aforementioned discrepancy error between state and balances because it first calls _updatePoolBalance(), then it transfers loan tokens in.

Impact

If a pool owner transfers tokens in, but the IERC20(pools[poolId].loanToken).transferFrom() call fails, the pool balance will be incremented in state, but the tokens wouldn't be transferred in, which leaves an opportunity for the pool owner to withdraw more tokens from the Lender.sol contract than they've actually deposited since the Lender contract itself holds all deposits.

Tools Used

Manual review

Recommendations

Use safeTransfer or require that the transfer call actually returned true as a result.