Beedle - Oracle free perpetual lending

Summary

It is possible to give pool loans to same pool via giveLoan() function.

Vulnerability Details

Description:

Given pool A and loan A, it's possible for lender A to call giveLoan() function and give loan A back to pool A.
Normal intended functionality is for lender A to give loan A from pool A to lender B from pool B.
There is no check to validate poolIds from the bytes32 array function parameter.

Impact

Risk:

It seems that all the accounting happens correctly, except for one step: On L403 the transfer() transfers protocolInterest to feeReceiver, but this step only usually happens during loan repayment by borrower, as well as(IF intended functionality?) during valid giveLoan() function calls when giving loans to other pools/lenders.

Tools Used

VSC, manual.

Recommendations

Add the following check on L396 just before the _updatePoolBalance() function:

        require(poolId != oldPoolId, "poolId invalid");
        
        OR
        
        if (poolId == oldPoolId) revert();