Beedle - Oracle free perpetual lending

Summary

If a pool uses an erc777 as its loan token, a malicious lender can callback into the addToPool() function and accumulate a pool.poolBalance that is much higher than what they have deposited into their pool.

Vulnerability Details

ERC777 allows for sender callbacks. Since the addToPool() function has no reentrancy protection and does not follow cei / frei-pi and allows malicious lenders to update their pool balance disproportionately to their deposited tokens.

Impact

This can lead to large scale loss of funds since Lender.sol is holding the balances for the pools, and there can be multiple pools with the same loan token.

(eg Good Lender A deposits 100 X token into their pool. Bad Lender B deposits 100 X token but reenters on the ERC777 sender callback and an extra 100 tokens are added to his pool balance. Bad Lender B can then removeFromPool() and steal 200 total X tokens, leaving Good Lender A with zero tokens to claim.

Tools Used

manual review and vs code

Recommendations

Add reentrancy guards, follow cei or frei-pi standards.