Beedle - Oracle free perpetual lending

Summary

Lender can buy his own loan to increase the interest rate

Vulnerability Details

When a lender no longer wants to keep the loan, they can start an auction to sell the loan. During the auction, the interest rate increases over time. In principle, the lender cannot change the interest rate of the loan. However, they can adjust the interest rate by buying their own loan.

For example, let's assume that the LoanToken is USDT and the collateral token is DAI.

scenario

1. Lender of Pool A start an auction of Loan B (interest rate of 1%, Auction Length: 1 day)

2. Lender of Pool A wait for 10 minute

3. (MAX_INTEREST_RATE * timeElapsed) / loan.auctionLength = (100000*600)/86400 = 694.4444444444

4. The loan’s interest rate is now 6.94%

5. Now Lender of Pool A buys the loan at a higher interest.

6. Borrower will get a loss because of higher interest rate than he expected

Impact

The borrower needs to pay more interest than he expected.\

Tools Used

vscode

Recommendations

It is recommended to discourage the lender from buying a loan that is in their own pool.