Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

The collateral ratio doesn't get checked when buying an auctioned loan, disabling some protocol functionalities for the borrower

KrisApostolov

Summary

The collateral ratio of a loan getting bought by a pool doesn't get checked for compliance with the new pool, disabling refinance() for the user and giveLoan() for the lender.

Vulnerability Details

The buyLoan() function doesn't check whether the loan is compatible with the pool it is getting transferred into.

// @audit no such check here:
if (loan.auctionStartTimestamp == type(uint256).max)
revert AuctionNotStarted();
if (block.timestamp > loan.auctionStartTimestamp + loan.auctionLength)
revert AuctionEnded();

Impact

This will disable the user from calling refinance() and the lender from calling giveLoan() as both of these functions have a check for whether the token ratio is within the maxLoanRatio's boundaries.

uint256 loanRatio = (debt * 10 ** 18) / collateral;
if (loanRatio > pool.maxLoanRatio) revert RatioTooHigh();

Tools Used

Manual Review

Recommendations

Consider checking whether the token ratio of the loan is compatible with the pool in buyLoan().

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.