Beedle - Oracle free perpetual lending

Summary

In, lender.sol refinance() function the poolbalance of the pool which is refinancing the loan is reduced by the debt value in the same function at two instances, which brings in wrong account keeping of the balances, and a loss to the pool lender.

Vulnerability Details

In refinance() function which transfers the loan from one pool to another, the poolbalance and outstanding pools are updated. But the poolBalance of the new pool is updated two times. i.e reduced by the debt amount at two instances.

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L636
https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L698

Impact

This is clearly not expected to happen as per the logic, and affects the account keeping of the pool balances. The major impact goes to the pool lender, whose balance reduces for no reason and can't be reverted back.

Tools Used

Manual Review

Recommendations

Remove the code of line updating the pool balance for the second time.