20,000 USDC
View results
Submission Details
Severity: medium

Old lender is charged with paying protocolInterest

Summary

During a loan transfer, the original lender is charged with paying the protocol interest and doesn't get this amount back.

Vulnerability Detail

File: Lender.sol
function giveLoan(
uint256[] calldata loanIds,
bytes32[] calldata poolIds
) external {

This function is called by lenders, to transfer their loan to another pool. In the line:
IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
The original lender covers the protocolInterest, but it's based on the borrower's accumulated interest. The lender needs to be reimbursed this amount.

Impact

Original lenders could be unfairly charged, leading to monetary loss.

Tools Used

A thorough review of the code base was conducted to identify this issue.

Recommendation

Consider adding the protocolInterest amount to the lender's balance.

File: Lender.sol
_updatePoolBalance(
oldPoolId,
pools[oldPoolId].poolBalance + loan.debt + lenderInterest + protocolInterest
);

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.