Beedle - Oracle free perpetual lending

Summary

The lender can scam the borrower by changing the interest rate

Vulnerability Details

When the lender creates a new pool, he sest an initial interest rate for future borrowers. If he create a pool with popular tokens and a very low interest rate, most of the borrowers will prefer his pool because it is more profitable for them. Currently, every lender can change the interest rate of their pool at any time. This opens up the potential for lenders to scam their borrowers as they increase the interest rate when they see a borrowing transaction in their pool (front-run attack). The lender will increase the interest rate and as a result, the borrower will have to pay more interest fees than initially expected.

Impact

The borrower will lose money because he has to pay more interest.

Tools Used

Manual review

Recommendations

Add an interestRate parameter in the Borrow struct. The borrower will provide the interest rate of the pool and in the borrow function, add check if the interest rates match with the given and actual rates of the pool.