Beedle - Oracle free perpetual lending

Summary

Missing input validation to check that loanToken and collateralToken is not the zero address

Vulnerability Details

when the function setPool is called to create a pool, there is no check on the Pool struct to confirm that loanToken and collateralToken is the zero address

Impact

if the loanToken or collateralToken is the zero address any call to it (such as transfer or transferFrom) will execute successfully without actually carrying any action which could break the pool token accounting

Tools Used

Manual Analysis

Recommendations

Add a require to check that loanToken and collateralToken is not the zero address