Beedle - Oracle free perpetual lending

Summary

User who has approved the tokens to lender contract it can be frontrunned

Vulnerability Details

function setPool(Pool calldata p) public returns (bytes32 poolId) {
// validate the pool
if (
p.lender != msg.sender ||
p.minLoanSize == 0 ||
p.maxLoanRatio == 0 ||
p.auctionLength == 0 ||
p.auctionLength > MAX_AUCTION_LENGTH ||
p.interestRate > MAX_INTEREST_RATE
) revert PoolConfig();

}

In the if(){} statement we can put any one of parameter to condition that can bypass the all these checks
ex: we can set p.maxLoanRatio = 1.5 and set the p.lender = user(who has approved the tokens to the contract}

When the execution comes to
IERC20(p.loanToken).transferFrom(
p.lender,
address(this),
p.poolBalance - currentBalance
);

it will transfer the approved token to the lender contract

Impact

When the user will try transfer the token, it will fail

Tools Used

manual review

Recommendations

add the check : require(p.lender == msg.sender, "err_msg")