Beedle - Oracle free perpetual lending

Summary

Reentrancy in the setPool function allows an attacker to drain the contract balance of any ERC777 tokens

Vulnerability Details

In the setPool function, an attacker is able to re-enter and drain the contract balance of any ERC777 tokens by first creating a pool with a pool balance, then reducing the pool balance. when the contract tries to send the excess token the attacker reenters the setPool again untill the balance is empty

Impact

the attacker is able to drain the contract of any ERC777 token

Tools Used

Manuel Analysis

Recommendations

apply a reentrancy guard modifier to the setPool function