Beedle - Oracle free perpetual lending

Summary

Users can lose funds while swapping profits or an attacker can make the funds at risk.

Vulnerability Details

The "sellProfits()" is to swap loan tokens of the fees contract for collateral tokens from liquidations.

The code provided above used to create params for token swapping with a settings "amountOutMinimum: 0". This omission of slippage protection can result in potential losses of user funds. Additionally, the lack of access control allows anyone to invoke "sellProfits()," putting user funds at risk.

Impact

Funds may be lost during token swapping for loans, either by the user alone or due to a hacker.

Tools Used

Manual Review

Recommendations

Implement a slippage protection mechanism by calculating the "amountOutMinimum" to prevent potential fund loss. Additionally, implement an access control mechanism to restrict access to only intended users.