Beedle - Oracle free perpetual lending

Summary

Anyone can call the sellProfits function and although the receiver is the contract itselfs, an attacker can take advantage and decrease the profit generated.

Vulnerability Details

Because the sellProfits function can be called by anyone, a malicious actor can take advantage of this, since the amountOutMinimum is set to 0, as this parameter is a measure of protection against market fluctuations and price changes. price during the transaction allowing the possibility of a sandwich attack, manipulating the price before the transaction takes place and the attacker caught from this.

Impact

Directly in the fees collected that would be the profit of the protocol

Tools Used

Manual code review

Recommendations

Prevent anyone from calling this function