Beedle - Oracle free perpetual lending

setPool is vulnerable to the reentrancy attack which allows pool manager to drain entire ERC777 token balance of the contract.

POC:

Attacker sets a pool with pool balance of 2 TKN. Then they update it to 1 TKN. The contract will transfer them 1 TKN.

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L159

Since ERC777 has callbacks it will allow the attacker to reenter the function and drain all everything from the contract.

Mitigation:

Disallow ERC777 tokens

Implement reentrancy protection