Submission Details
Severity:
The lender can change the interest rate at any time by resetting the pool without a delay
Summary
setPool and updateInterestRate functions in Lender.sol contract allow the lender to change the interest rate to up to 1000% at any time without a delay, this also includes frontrunning the borrowers' transactions.
Vulnerability Details
Impact
The arbitrary change of interest rates may be unexpected for borrowers and can result in an inability to repay the loan on time.
Tools Used
Manual Review
Recommendations
Consider adding a delay (for instance: 1 day) for the interest rate update to go live in both the setPool and updateInterestRate functions.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.