refinance() - borrower can opt to refinance even when after the auction has started
Summary
The refinance() function can be called by the borrower, even while the auction is going on.
Vulnerability Details
There is no restriction in the refinance() function, to be not called while the auction is live for the same loan.
Impact
1.The borrower can choose the new pool, even when the auction has started, which affects the fairness of the Dutch auction.
2. At the end of the auction, the borrower can save the loan from being seized, by picking a pool, even when no pool is interested to participate in the auction.
Tools Used
Manual review
Recommendations
in refinance() function, error should be reverted if the auction is live.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.