Beedle - Oracle free perpetual lending

Summary

The contract lacks protection against reentrancy attacks in functions that interact with external contracts, such as withdraw. This can be exploited through a malicious contract, allowing an attacker to manipulate the state of the contract, potentially draining funds or causing other inconsistencies.

Vulnerability Details

The functions perform external calls without employing reentrancy protection mechanism such as mutexes.

A malicious contract could be designed to re-enter the vulnerable functions, manipulating the state during the process.

Impact

Financial Loss: An attacker could withdraw more tokens than they are entitled to, leading to a loss of funds in the contract.
Integrity Loss: The lack of reentrancy protection can lead to inconsistencies in user balances, undermining the contract's correctness.

Tools Used

Manual

Recommendations

Implement reentrancy guards