Submission Details
Severity:
Attacker can DoS manager from removing funds from the pool
Attacker can frontrun manager's withdrawals from the pool using
https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L198
by running borrow()
It'll update poolBalance making withdraw requests impossible.
Migitation steps:
Implement different status for a pool: ACTIVE or PAUSED. Borrows and loan assigment should only be possible when the pool is ACIVE.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.