Beedle - Oracle free perpetual lending

Summary

An operator takes out a loan and then sends it into an auction. He then buys the loan through the buyLoan() but uses another lenders poolId.

Note: Operator has to make sure the pools interest rate is less than or equal to the currentAuctionRate

Vulnerability Details

1. Operator gives himself a loan

2. Operator sends loan into auction

3. Operator buys loan via buyLoan using another lenders poolId.

Impact

Operator can force a lender to buy his loan

Tools Used

manual

Recommendations

Check that msg.sender is lender for poolId provided.