Beedle - Oracle free perpetual lending

Summary

Lender can take more collateral tokens than deposited by borrower.

Vulnerability Details

In the seizeLoan function a malicious lender can cause reentrancy attack in line 565 in which collateral is transferred to the lender,so if the lender is a malicious contract then it can reenter and call the seize function again as the loan is deleted at the end this gives rise to this vulnerability.

Impact

Ultimately extra collateral tokens taken by the lender are from the lender.sol contract causing loss of funds.

Tools Used

Manual Review

Recommendations

First delete the loan from loans array and then transfer the collateral tokens.