Beedle - Oracle free perpetual lending

Summary

The debtAmount can exceed collateralAmount*(p.maxLoanRatio/1e18), even though loanRatio is less or equal to the pool's maxLoanRatio.

Vunerability Details

An invariant used in the Lender borrow tests is as follows:

That is, the debtAmount must not exceed the LTV, which is the collateralAmount times the loanRatio (as a factor). However, for some collateral and/or debt values, the debtAmount can exceed collateralAmount*(p.maxLoanRatio/1e18), even though the loanRatio is less than or equal to the p.maxLoanRatio .

As an example, given a maxLoanRatio of 1e18, a debtAmount of 100e18, and a collateralAmount of 99999999999999999901 , the above invariant is broken. These values also cause the tests testFuzz_borrow() and test_borrow() to fail.

As such, even though the check on Lender.sol line 247 passes, the debtAmount exceeds the LTV, breaking the invariant.

Impact

Medium

Tools Used

Foundry

Recommendations

Change the check loanRatio > pool.maxLoanRatio, to loanRatio >= pool.maxLoanRatio.