Beedle - Oracle free perpetual lending

Summary

There is a potential reentrancy attack vector in Lender.sol's repay function. If one of the tokens being transferred in the function makes use of the before/after token transfer callbacks, a malicious actor could potentially reenter and drain the pool.

This vector also appears in the seizeLoan function.

Vulnerability Details

ERC20 callbacks open up the possibility of reentrancy.

Impact

Pools can potentially be drained during reentrancy

Tools Used

Manual Review

Recommendations

Follow standard Checks/Effects pattern, and move the delete loans[loanId] line in Lender.sol's repay function to before the tokens are transferred to prevent the same loanId from being used to drain the pool in a reentrancy attack.