Beedle - Oracle free perpetual lending

Summary

Multiple functions uses the Staking.update function to update the rewards, but that do not work correctly, so the user would not see their rewards reflected.

Vulnerability Details

When you start the process in the deposit function for example, where the user for the first time will try to collect reward. After the token transfer is successful, updateFor is called.

It calls update and when found in this statement:

This scenario can happen, if users make use of these functions and there are still no deposits in WETH, that if the Lender.sol contract does not place the address of the Fees.sol contract, users may not have rewards

Impact

Users will not earn rewards

Tools Used

Manual code review

Recommendations

Ensure that when depositing, the contract has WETH for the reward mechanism to work.