Submission Details
Severity:
Missing checks for if caller is pool lender when buys a loan
Summary
Missing checks for if caller is pool lender when buys a loan.
Vulnerability Details
User is expected to own a pool to buy a loan, however, such check is missing in buyLoan(uint256 loanId, bytes32 poolId).
buyLoan can be called by anyone without owning the pool assoicated with the poolId parameter, results in anyone can get a loan for free.
Impact
Pool owner can lose money without getting a loan.
Tools Used
Manual Review
Recommendations
Add checks for if caller is pool lender to buyLoan.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.