Beedle - Oracle free perpetual lending

Summary

The giveLoan function does not check if loanIds and poolIds have the same length. This can lead to unexpected results.

Vulnerability Details

Common practice in situations is to verify that the lengths are equal to ensure the user did not make a mistake.

Impact

The transaction will revert during _updatePoolBalance(poolId, pool.poolBalance - totalDebt); as pool.poolBalance - totalDebt would become negative and revert.

Tools Used

manual review

Recommendations

add
require(loanIds.length == poolIds.length, "mismatched array lengths");