Beedle - Oracle free perpetual lending

Summary

Due to sellProfits being public people can wait and call it in bad times to reduce the profits for the system.

Vulnerability Details

Example scenario is when Lender contract generates 5 WETH in profits and current price of WETH 2000$ two thing can occur:

• Attacker waits until the price raises (for example 2100$) and then calls sellProfits.

• Because it is public an attacker, may sandwich this TX with a flash loan trade.

To sandwich it with your smart contract (or a bot) you will need to execute a single transaction where:

1 Take a Flash Loan.

2 Buy WETH from the uni pool that Fees use.

3 Call sellProfits

4 Sell all of the WETH that you have bought.

5 Repay the Flash Loan.

6 Profit

Impact

Reduced profits for the system.

Tools Used

Manual review

Recommendations

Put an access modifier on the function, so only the owner can call it.