Borrower can reset auction to not get liquidated
Summary
Any ongoing auction is reset if the borrower calls the refinance function. Thus, a borrower can stop a refinancing auction to prevent him from being liquidated.
Vulnerability Details
When calling the refinance function the loans[loanId].auctionStartTimestamp is reset to type(uint256).max which resets any ongoing auction.
https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Lender.sol#L692
Impact
An insolvent borrower can indefinitely maintain his position by calling the refinance function, with or without updating any loan parameter.
Tools Used
Manual review
Recommendations
loans[loanId].auctionStartTimestamp should only be reset if the pool maxLoanRatio is met.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.