Beedle - Oracle free perpetual lending

Summary

In Lender.sol the giveLoan function accounts for the user's debt wrongly.

Vulnerability Details

The giveLoan function transfers a loan to another pool. Before transferring, the accumulated lenderInterest and protocolInterest for the loan are accounted for and added to the totalDebt variable. The issue is that when transfering the loan to a new pool, instead of setting the new debt amount to the original debt of the user, it is set to totalDebt.
The loan's interest is only calculated according to the time that the loan has been active, so when the lenderInterest and protcolInterest are accounted for and transferred in the old pool, they should not be relevant to the debt of the new pool.
Currently, when a loan is given to another pool, the loan's interest is paid to the old pool, then that same interest is accumulated to the debt of the user in the new pool, forcing the user's debt and loan interest to increase in the new pool, although they should stay the same.

Impact

The inaccurate accounting leads to a loss of funds for the user.

Tools Used

Manual review

Recommendations

Use debt instead of totalDebt when giving a loan to a new pool.