Beedle - Oracle free perpetual lending

Summary

It is not checked if the caller of the buyLoan function has a pool with tokens.

Vulnerability Details

Missing this check, allow malicious user to buy loans for another user pool.

https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Lender.sol#L465-L534

Impact

Alice can buy as many loans as she wants for Bob's pool, even though Bob doesn't want them. By doing this, Bob's balance in the pool will decrease significantly.

Tools Used

Manual Review

Recommendations

Add this check
if (msg.sender != pools[poolId].lender) revert Unauthorized();