The formulaes should be adjusted for token precision differences
https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L246
https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L384
https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L618
maxLoanRatio is not respected when loanToken and collateral have different precisions, i.e
loanToken is wbtc and collateralToken is weth
uint256 loanRatio = (debt * 10 ** 18) / collateral
It's not clearly stated how maxLoanRatio translates to percentages but protocol developers use 10 ** 18 in the tests a lot.
In the case of WBTC and WETH the result will be much smaller than 10 ** 18 which allows an attacker to steal the funds.
Mitigation steps:
uint constant BPS = 10000;
uint256 loanRatio = (debt * 10 ** collateral.precision() * BPS) / (collateral * debt.precision());
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.