Beedle - Oracle free perpetual lending

Vulnerability Details

The vulnerability occurs because the giveLoan function performs an external call to IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest) before updating the state variables. If the external contract being called (i.e., IERC20(loan.loanToken)) triggers a reentrant call back into the giveLoan function or any other function in the contract before the state variables are updated.

Impact

The impact of the reentrancy vulnerability in the giveLoan function could lead to potential loss of funds or even manipulation of state variables during loan processing due to an external contract calling back into the function before the state is updated, allowing malicious actors to exploit the contract.

Tools Used

Slither

Recommendations or Mitigation

To mitigate this vulnerability, the checks-effects-interactions pattern should be followed to ensure the state is updated before any external calls are made.