A borrower might end up borrowing without depositing collateral
Summary
When borrowing, a borrower has to deposit collateral from one ERC20 token in exchange for a loan in a second ERC20 token. However, some ERC20 tokens do not revert on transfer call failures and this leaves room for the borrower to borrow without putting up any collateral leaving them with no incentive to repay the loan.
Vulnerability Details
See summary.
Impact
Borrowers can occasionally happen to borrow loan tokens without putting up collateral tokens which leaves them with no incentive to repay their loan and ultimately causing the pool owner to incur a loss.
Tools Used
Manual review
Recommendations
Use safeTransfer when transferring in collateral tokens in Lender.sol#borrow() or just require that the transfer call returned true as a result.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.