Beedle - Oracle free perpetual lending

Summary

When the borrowers want to repay the loan, the loan might be 20 tokens but when the Transaction actually gets executed,
the additional interest rate can be accrued over that period of time due to which the borrower has to pay more money or token than he actually deserves like paying 40 instead of 20.

Vulnerability Details

If we look at the implementation of repay, we can see that it depends upon the _calculateInterest function
to see how many tokens the borrower has to pay.

Deep inside, _calculateInterest there is a dependency on the block.timestamp.

which increases over time.

_calculateInterest

If a user submits the repay Transaction at time t1 and his amount to repay is 30 token,
then when the transaction actually gets executed at time t2, the tokens can be much larger than 30, maybe 1000.

This can happen due to the Transaction being executed by delay .
Possible causes

-> Network congestion
-> Priority fees for other transactions are high

This scenario will cause a loss of funds to the user if he has more than 30 tokens in his account.

if he does not have, then he will be subject to liquidation which is not a fair thing to him.

Impact

-> Loss of funds to Borrowers / Users

-> Loss of Trust of Users on Protocol

Tools Used

Manual Review

Recommendations

The protocol should devise some mechanism to record the time of instantiation of transaction,
to safeguard users' interests.