Beedle - Oracle free perpetual lending

Summary

buyLoan can be called by any user, even ones not owning a pool to move a random loan to a different pool.

Vulnerability Details

Although comments suggests that this function should only interact with your pool, there is no reinforcement on it. And because of that anyone can DoS any pool owner by simply moving any of the loans to his pool.

Example:

• Pool owner is planing to leave the system, having 4k in loan tokens and last borrower of his spool has just payed 1k (5k in total)

• Malicious user calls buyLoan on any random loan (that matches collateral and loan tokens) to move it to his pool and eat up his loan tokens.

• Now pool owner is not being able to withdraw his loan tokens and needs to wait until this borrower pays his debt

Impact

Anyone can mess up the poo owner intentions and Dos them of their loan/collateral tokens.

Tools Used

Manual review

Recommendations

Have an if() to prohibit using this function with any pool that is not yours.