Beedle - Oracle free perpetual lending

Summary

In the refinance function of Lender.sol the same debt is subtracted twice from the same pool.

Vulnerability Details

Firstly, in refinance, debt is subtracted from the new pool by calling the _updatePoolBalance function:

However, at the end of the function, the same debt is taken out again of the already updated poolBalance:

Impact

The accounting error is detrimental for the pool, as the pool balance would be wrongly decreased and an issue of lack of funds would emerge, threatening the finances of other users to be stuck in the contract. Furthermore, it is rather easy for any user to accidentally cause the issue.

Tools Used

Manual review

Recommendations

Update the balance of the new pool only once.