Beedle - Oracle free perpetual lending

Summary

Occurrence of various external calls to IERC20 inside an unbounded for-loop.

Vulnerability Details

External calls to IERC20 within an unbounded for-loop creates a possible DOS attack. In this case, the functions 'refinance', 'seizeLoan', 'startAuction', 'giveLoan', 'repay', and 'borrow' contain this vulnerability. An attacker could exploit this by creating conditions where the for-loop continues indefinitely, causing the smart contract to exhaust its gas limit.

Impact

Legitimate interactions with the contract—like refinancing loans, seizing loans, starting auctions, giving loans, repaying loans, and borrowing—could be blocked if exploited.

Tools Used

1. VS Code

2. Hardhat

3. Manual Review

Recommendations

Consider limiting the number of iterations in for-loops that make external calls.