Summary

Check missing to prevent borrower from interacting with/repaying his loan after failed refinance auction.

Vulnerability Details

No checks currently in place to prevent borrower from interacting with(i.e. repaying) the loan after loan failed refinance auction. Is this intended functionality?

So the seizeLoan() is manually called and can be called by anyone. Ok cool, but during the time before anyone calls this seizeLoan() function the borrower could still interact with his loan, maybe try repay it, maybe successfully? And then boom goes the protocol accounting...

In fact, seems lender also could still interact with this loan even after failed refinance auction, as long as he interacts before someone calls the seizeLoan() function. Maybe the lender can send the loan to another pool to complicate internal accounting mess even more?

If I'm wrong with the above analysis, apologies, I did not deep-dive this as much as the others.

Impact

Messed up internal/pool/protocol accounting.

Tools Used

VSC, manual.

Recommendations

Implement checks to ensure borrower and lender cannot interact with loan after failed refinance auction. These checks need to be activated as soon as the refinance auction fails.

The only action that should be allowed to be taken after refinance auction fails, is to call the seizeLoan() function.