Beedle - Oracle free perpetual lending

Summary

When removing tokens from a pool, pool owner might end up having their tokens stuck in the Lender contract because of a failed ERC20 transfer call.

Vulnerability Details

When removing tokens from a pool, the contract first updates the pool's loan token balance in state and then proceeds to make an unsafe transfer call to the pool owner. Since some ERC20 tokens do not revert on failure, this might end up leaving some tokens stuck in the contract.

An example scenario would look like this:

1. A pool owner has deposited 1000 loan tokens – pools[poolId].poolBalance = 1000

2. Pool owner decides to withdraw 1000 loan tokens, _updatePoolBalance(poolId, 1000 - 1000) is executed

3. The unsafe transfer call is executed, but fails

4. Now pools[poolId].poolBalance = 0

5. When pool owner decides to give the withdrawal another try, _updatePoolBalance will underflow and revert. Owner's 1000 loan tokens are now stuck in the contract.

Impact

Pool owner wouldn't be able to now

Tools Used

Manual review

Recommendations

Use a safeTransfer() call instead or require that the transfer returned true as a result.