Beedle - Oracle free perpetual lending

Summary

Not checking the success of ERC20 transfers leads to numerous vulnerabilities

Vulnerability Details

In Lender.sol both collateral and loan tokens are unsafely transferred. There are many widely-used ERC20 tokens that do not revert on an unsuccessful transfer but instead return a boolean. The return value of transfer and transferFrom is never checked throughout the contract which could lead to wrong state changes even though tokens were never transferred.
For example, in the repay function a user may not have the necessary balance to repay their loan but if the loan token does not revert on failure the repay function would also not revert and they would be able to repay their loan for free, without actually sending any tokens.

Impact

The lack of safety when using ERC20s throughout the entire contract can lead to significant losses for both the protocol and its users.

Tools Used

Manual review

Recommendations

Use the SafeERC20 library.