Beedle - Oracle free perpetual lending

Summary

The refinance function does not check if the loan is defaulted (i.e., the auction has ended, and the collateral can be seized). This allows the borrower to prevent the loan from being seized by refinancing with the same terms.

Vulnerability Details

A borrower can prevent their loan collateral from being seized by calling the refinance function with the same terms (the debt needs to be slightly adjusted to incorporate the accrued interest). This resets the auctionStartTimestamp to type(uint256).max in line 692 and thus stops the auction. The lender can no longer seize the loan and would have to restart the auction.

The borrower can repeat this process indefinitely to DoS the seizing process.

Lender.sol#L692

Impact

The lender cannot seize the defaulted loan and is potentially DoSed.

Tools Used

Manual Review

Recommendations

Consider only allowing the borrower to refinance the loan when the loan is not seizable (i.e., the auction ended).