Beedle - Oracle free perpetual lending

Summary

The unchecked return value from transferFrom can allow anyone to steal tokens from the lender contract

Vulnerability Details

The functions setPool and borrow calls an unsafe transferFrom. For certain ERC20 tokens, if insufficient tokens are present, no revert occurs but a result of “false” is returned.

Impact

The unchecked return value from the call to transferFrom essentially allows;

1. attacker to call setPool and create pools without actually sending any loanToken

2. attacker to call borrow and borrow tokens from pools without actually putting up any collateral

3. attacker to call repay and repay loans without actually paying back their loans

e.t.c

Tools Used

Manual Analysis

Recommendations

consider using openzepplin SafeERC20 or checking the return value from the transfer from function call