Borrower can front-run seizeLoan function by calling repay
Summary
In Lender.sol a borrower can front-run seizeLoan function by calling repay.
Vulnerability Details
If a user front-runs a call to seizeLoan by calling repay, the call to seizeLoan would deceive the lender. Even though the loan is already deleted in the repay function, seizeLoan would not revert as it does not check whether the loan still exists. The transaction would be successful and the lender would be misled to believe that they have seized the loan and acquired the collateral.
Impact
The seizeLoan function would give unexpected and deceiving results.
Tools Used
Manual review
Recommendations
Check whether the loan still exists in seizeLoan function.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.