Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Rebasing tokens go to the pool owner, or remain locked in the various contracts

33audits

Summary

Rebasing tokens are tokens that have each holder's balanceof() increase over time. Aave aTokens are an example of such tokens.

Vulnerability Details

When depositing in Lender.sol, users expect that when they deposit tokens to a pool, they get back all rewards earned, not just a flat rate. With the contracts of this project, deposited tokens will grow in value, but the value in excess of the pre-calculated _updatePoolBalance(poolId, pools[poolId].poolBalance + amount); amounts go solely to the owner/creator, or will remain locked in the contract

Impact

If rebasing tokens are used as the collateral token, rewards accrue to the contract and cannot be withdrawn by either the user or the owner, and remain locked forever.

/// @notice add to the pool balance
/// can only be called by the pool lender
/// @param poolId the id of the pool to add to
/// @param amount the amount to add
function addToPool(bytes32 poolId, uint256 amount) external {
if (pools[poolId].lender != msg.sender) revert Unauthorized();
if (amount == 0) revert PoolConfig();
_updatePoolBalance(poolId, pools[poolId].poolBalance + amount);
// transfer the loan tokens from the lender to the contract
IERC20(pools[poolId].loanToken).transferFrom(
msg.sender,
address(this),
amount
);
}

Tools Used

Manual Review.

Recommended Steps

Provide a function for the pool owner to withdraw excess deposited tokens and repay any associated taxes.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.