Beedle - Oracle free perpetual lending

Summary

The buyLoan() function doesn't check if the tokens are same between the loan and the pool but allows to transfer the loan.

Vulnerability Details

In buyloan() function, the loan token and collateral tokens of the loan and the pool are not checked if they are same.

Impact

This allows the loan to be transferred to a different pool, with different tokens, which completely violates the fundamental logic of the lending protocol and affects the accounting of tokens in the contract and the actual tokens owned by the contract.
This opens up multiple opportunities for both lender and borrower, to buy or sell the loan with different token of less/more value.

Tools Used

Manual Review

Recommendations

Check if the loan and collateral tokens are same before transferring the loan.