Summary

Potential reentrancy attack vector to drain all collateral funds from Lender contract.

Vulnerability Details

The seizeLoan() function has no access control, and since it doesn't follow the CEI pattern, reentrancy is made possible by two transfer() functions, but especially by the transfer() function which sends collateral tokens to the lender. If the lender is rogue/attacker and uses a contract for his lender address, and if the collateral ERC20 token enables callback, then the attacker could successfully reenter the seizeLoan() and execute everything successfully up to the transfer functions and reenter multiple times, until the Lender contract is drained of all collateral funds, which were transferred to the lender address.

Impact

Lender contract could potentially be drained of all collateral tokens during one reentrancy attack by rogue lender.

Tools Used

VSC, manual.

Recommendations

Add reentrancy modifier or mutex lock.