Beedle - Oracle free perpetual lending

Summary

A malicious lender can induce the borrower to pay more interest than he should by changing the loan token in the setPool() function.

Vulnerability Details

Malicious lender can set a new loan token via the setPool() function. This function doesn't check whether the new loan token is the same as the token that was before. As a result, the getPoolId() in the repay function will return a different hash.

As poolId refers to another pool, outstandingLoans will be zero, and the transaction will revert due to underflow:

The lender can set the maximum interest rate and wait for some time. Then, they can change the loan token back and allow the borrower to repay their loan

Impact

Borrower will have to pay more interest.

Tools Used

Manual Review

Recommendations

Don't allow the lender to change or loan token