Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Should not add interest to loan debt when lender buys a loan

JMTT

Summary

Should not add interest to loan debt when lender buys a loan.

Vulnerability Details

In buyLoan(uint256 loanId, bytes32 poolId), interest is added to loan debt:

loans[loanId].debt = totalDebt;

This leads to more interest to be accumulated on the loan in the future, as the interest is calculated based on the debt:

function _calculateInterest(
Loan memory l
) internal view returns (uint256 interest, uint256 fees) {
uint256 timeElapsed = block.timestamp - l.startTimestamp;
interest = (l.interestRate * l.debt * timeElapsed) / 10000 / 365 days;
fees = (lenderFee * interest) / 10000;
interest -= fees;
}

Imagine the following scenario, a borrower borrows 1000e18, interestRate is 5%, the borrower is expected to pay 50e18 in a year, however, if after 6 months, the accumulated interest is 25e18, the lender sells the loan, the loan debt becomes 1025e18 loan token, and borrower need to pay 25.625e18 in the next 6 months, that is 1050.625e18 in total.

Impact

Borrower will be required to pay more interest.

Tools Used

Manual Review

Recommendations

To fix this vulnerability, the accumulated interest should not be added to loan debt when lender buys a loan.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!