New lender is charged with paying protocolInterest
Summary
During a loan transfer in the function buyLoan, the original lender is charged with paying the protocol interest, but doesnt get it back.
Vulnerability Detail
IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
In the buyLoan function, new lenders shoulder the protocolInterest fee, an amount incorporated into the borrower's accumulated interest. This fee is then deducted from their balance.
Impact
New lenders might face unexpected deductions, leading to financial losses.
Tools Used
A thorough review of the code base was conducted to identify this issue.
Recommendation
The fee should not be substracted from his new balance :
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.