Beedle - Oracle free perpetual lending

Summary

giveLoan() allows lenders to reset the auctionStartTimestamp of a loan even though this is not an intended privilege of theirs.

Vulnerability Details

Lender.sol's giveLoan() allows for a pool lender to give a loan to the very pool, that is holding it at that point in time as there is no explicit check disallowing it. It presents a vulnerability as the lender can now mutate how auctions work instead of them being started once and not being changed after that.

The only cost the lender needs to pay for this action is the protocolFee, which gets cut from the loan's accrued interest.

Impact

It allows gives lenders an unintended privilege, which enables them to have more control over the loans they are lenders for.

Tools Used

Manual Review

Recommendations

Consider adding a check to the giveLoan() that disables such behavior by not allowing the lender to give a loan to the same pool it originates from.