Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Borrows can pay higher interest than expected

aak

Summary

The lender can frontrun a borrow transaction to charge a higher interest than the borrower expected.

Vulnerability Details

The borrower will have to go through a high interest rate even though they saw a lower interest rate at the time of signing the transaction. The loan parameters are created as:


Loan memory loan = Loan({
lender: pool.lender,
borrower: msg.sender,
loanToken: pool.loanToken,
collateralToken: pool.collateralToken,
debt: debt,
collateral: collateral,
interestRate: pool.interestRate,
startTimestamp: block.timestamp,
auctionStartTimestamp: type(uint256).max,
auctionLength: pool.auctionLength
});


Here, the loan’s interest rate is coming from pool.interestRate which the lender can increase by calling setPool or updateInterestRate through frontrunning.

Impact

Borrowers will pay the interest rate higher than expected for their loans.

Tools Used

Manual review.

Recommendations

Update Borrow struct to include maxInterestRate field. This denotes the maximum interest rate the borrower is willing to pay. Now revert in borrow function if borrows[I].maxInterestRate < pool.interestRate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.