Beedle - Oracle free perpetual lending

Summary

The Lender.sol contract does not support fee-on-transfer tokens. If either loanToken or collateralToken has a fee-on-transfer mechanism, the actual amount of tokens sent or received by users and the protocol could be less than the amount specified in the transfer.

Vulnerability Details

The addToPool function in Lender.sol receives tokens from the user with amount as an input. If the loanToken has a fee-on-transfer mechanism then the actual amount received by Lender.sol will be less than the amount passed as an input. The addToPool function will then call _updatePoolBalance function which will update the pools mapping with an inflated amount, leading to all sorts of accounting problems.

This behavior is present across the whole Lender.sol contract.

Impact

The protocol and users could suffer a loss of funds.

Tools Used

Manual Review, Solodit

Recommendations

Consider checking the balance of the contract before and after token transfers and using them instead of the amount specified as an input.