Borrower can get more loan tokens and more collateral than he is bound to get after refinancing if the borrower increases its debt and decreases his collateral
Summary
Borrower can get more loan tokens and collateral after refinancing.
Vulnerability Details
If a malicious borrower refinancing his loan to a new pool, he can get more loan tokens if he increases its debt than the debtToPay because the transfer function sends debt - debtToPay - fee to the borrower and if the borrower is malicious he can cause reentrancy attack and again call the same function and get some more loan tokens because the updates are made after the transfers of the tokens.Similiarly if we decrease our collateral we pull the attack exactly similar to the attack pulled off by increasing the debt.
Impact
Causes loss of collateral token as well as loan tokens from the lender.sol
Tools Used
Manual
Recommendations
First make the updates and then make exeternal calls for transferring of the tokens.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.