Beedle - Oracle free perpetual lending

Summary

Lender's funds can be used as flashswap for free.

Vulnerability Details

Lenders provide their funds in order to generate interest. They are not interested to provide someone funds for free. However, current implementation of Lender contract can be used to get flashswap and lender receives nothing for that. This is because borrow function charges fee only to the protocol.

As result user can get as many loans as he wishes(because he can provide array of pools), then do what he wants with funds and then repay funds in same tx(as result no interests). This is not flashloan, but this is flash swap, user don't need to sell his collateral to get another token. And flash swapper will pay fee for this flashswap, but lender will receive nothing.

Impact

Lender do not receive flashswap fee, while their funds are in use.

Tools Used

VsCode

Recommendations

Looks like this should be restricted. So user can't repay in same tx.