Beedle - Oracle free perpetual lending

Summary

Lender can change the interest rate on a loan

Vulnerability Details

There is no check if the given poolId isn't the same as the oldPoolId. If Alice is a pool lender, she can buy a loan from her pool and change the interest rate on a loan.
https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Lender.sol#L465-L515

Impact

Alice can execute updateInterestRate and set a big interest of her pool, after that she will execute buyLoan function. By doing so, the loan associated with her pool – which was previously subjected to a lower interest rate – will be reconfigured with a significantly higher interest rate.

Tools Used

Manual Review

Recommendations

Add this check
if (poolId == oldPoolId) revert Error();