Beedle - Oracle free perpetual lending

Summary

Tokens not compliant with the ERC20 specification could return false from the transfer function call to indicate the transfer fails, while the calling contract would not notice the failure if the return value is not checked. Checking the return value is a requirement, as written in the EIP-20 specification:

Vulnerability Details

In lender.sol several places use transfer and transferfrom eg in ln563-565

Impact

transfer() might return false instead of reverting, in this case, ignoring return value leads to considering it successful.

Tools Used

Manual review

Recommendations

Use the SafeERC20 library implementation from OpenZeppelin and call safeTransfer or safeTransferFrom when transferring ERC20 tokens.