Beedle - Oracle free perpetual lending

Summary

The borrower of the loan is not stimulated to return the loan that he took.

Vulnerability Details

Anyone can take a loan and put some collateral but because the loan that they took is typically higher value than the collateral they put, they can decide that they don't want to return their debt even if that means that their collateral can be taken by the lender.

Proof Of Concept

Let's say that Bob borrows a loan from Alice's pool. The maxLoanRatio that Alice assigned is 2e18, which means that for every collateral token that Bob puts, two loan tokens can be taken. Bob now takes 200 loan tokens and puts 100 collateral tokens. The 200 loan tokens that Bob borrowed are probably worth more than the 100 collateral tokens. Now Bob can decide that he doesn't want to pay out the debt so Alice takes his 100 collateral tokens but she still lost money. Bob can continue to do this and acquire more and more assets while Alice loses value.

Impact

This leads to lenders losing money for lending their tokens, so they are less likely to use the protocol.

Recommendations

A blacklisted mapping can be implemented to keep track of the people that don't pay their loans. That way if someone doesn't pay their loan they can be blacklisted. This can be done in the seizeLoan function.