Beedle - Oracle free perpetual lending

Summary

The current implementation doesn't work with fee-on-transfer loan/collateral tokans.

Vulnerability Details

As arbitrary ERC20 tokens can be passed, the received amount should be calculated every time to take into consideration a possible fee-on-transfer or deflation.

When the lender add or remove lending tokens from the pool, the pool balance changes. Unfortunately, if the fee-on-transfer token is used for a loan, the actually received amount and pool balance will be different every time.

Impact

Difference between poolBalance and actual received amount.

Tools Used

Manual review

Recommendations

Use the balance before and after the transfer to calculate the received amount instead of assuming that it would be equal to the amount passed as a parameter.