User's borrow request can be front-run, resulting in receiving a loan with an interest rate higher than expected
Summary
The user's borrow request can be front-run, resulting in a change to an unfavorable interest rate.
Vulnerability Details
Every user is able to request a loan from an arbitrary pool. The new Loan struct is then created based on values previously set by the pool owner. Upon seeing that a user requests to borrow, the owner can front-run their transaction by calling the updateInterestRate function and change the interest rate to an unfavorable, the highest possible value.
Impact
Borrowers may get an undesired loan, with higher interest rates than they anticipated.
Tools Used
Manual review.
Recommendations
Allow users to pass to the borrow function the expected value of loan's interest rate.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.