Beedle - Oracle free perpetual lending

Summary

The lender can frontrun a borrow transaction to charge a higher interest than the borrower expected.

Vulnerability Details

The borrower will have to go through a high interest rate even though they saw a lower interest rate at the time of signing the transaction. The loan parameters are created as:

Here, the loan’s interest rate is coming from pool.interestRate which the lender can increase by calling setPool or updateInterestRate through frontrunning.

Impact

Borrowers will pay the interest rate higher than expected for their loans.

Tools Used

Manual review.

Recommendations

Update Borrow struct to include maxInterestRate field. This denotes the maximum interest rate the borrower is willing to pay. Now revert in borrow function if borrows[I].maxInterestRate < pool.interestRate.