Beedle - Oracle free perpetual lending

Summary

The Lender::setFeeReceiver() lacks checking the address(0), leading to transaction reverts on the borrow(), repay(), giveLoan(), buyLoan(), seizeLoan(), and refinance().

Vulnerability Details

The feeReceiver variable can be set by an admin through the setFeeReceiver(). The function does not check if the address(0) is inputted, though.

https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Lender.sol#L101

Impact

If the address(0) is inputted by mistake, the following functions will revert transactions.

• borrow() in L267

• repay() in L325

• giveLoan() in L403

• buyLoan() in L505

• seizeLoan() in L563

• refinance() in L651 and L656

Tools Used

Manual Review

Recommendations

I recommend reverting a transaction if the address(0) is inputted to the setFeeReceiver().