Beedle - Oracle free perpetual lending

Summary

Malicious lender can front-runs to set loan auctionLength to 1, results in a bad loan for the borrower.

Vulnerability Details

A loan can be put for auction at anytime, the auction will be ended after loan.auctionStartTimestamp + loan.auctionLength.

If auction is ended, the loan will be seized.

When a borrower create a loan by calling borrow, there is no check for the pool auction length, imagine the following scenario:

1. Alice submits a transaction to create a loan from a pool;

2. The pool lender Bob sees Alice's transaction in the mempool, and front-runs to decrease the pool auction length;

3. Bob's transaction gets executed, pool auction length is set to 1;

4. Alice's transaction gets executed, loan is created but loan auction length is 1.

Bob can then put the loan for auction immediately and the auction will be ended in a block, then Bob seize the loan and get the Alice's collaterals.

Impact

Borrower loses collateral.

Tools Used

Manual Review

Recommendations

When a loan is created from a pool, should check if the pool auction length is expected.