Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Refinancing makes lenders lost their funds

trtrth

Summary

In refinance logic, debt is moved from old lender pool to new one. So old lender pool balance should be increased and the new lender pool balance is deducted. However, in the implementation, the new lender pool is deducted two times, which causes balance deducted double as expected

Vulnerability Details

Pool balance deducted first time in refinance logic https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Lender.sol#L635-L637

Pool balance deducted again here https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Lender.sol#L697-L698

POC:
The PoC below is a customized version from origin test function test_refinance() and it does pass

function test_refinance() public {
test_borrow();
​
vm.startPrank(lender2);
Pool memory p = Pool({
lender: lender2,
loanToken: address(loanToken),
collateralToken: address(collateralToken),
minLoanSize: 100 * 10 ** 18,
poolBalance: 1000 * 10 ** 18,
maxLoanRatio: 2 * 10 ** 18,
auctionLength: 1 days,
interestRate: 1000,
outstandingLoans: 0
});
lender.setPool(p);
​
vm.startPrank(borrower);
Refinance memory r = Refinance({
loanId: 0,
poolId: keccak256(
abi.encode(
address(lender2),
address(loanToken),
address(collateralToken)
)
),
debt: 100 * 10 ** 18,
collateral: 100 * 10 ** 18
});
Refinance[] memory rs = new Refinance[](1);
rs[0] = r;
​
lender.refinance(rs);
​
bytes32 pId = keccak256(
abi.encode(
address(lender2),
address(loanToken),
address(collateralToken)
)
);
(, , , , uint256 poolBalance, , , , ) = lender.pools(pId);
assertTrue(
poolBalance == 1000 * 10 ** 18 - 2*r.debt
);
}

Impact

Lender pools balance get deducted and there is no way to recover. It does mean that lenders lost their funds

Tools Used

Foundry

Recommendations

Remove this line https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Lender.sol#L697-L698 so that accounting pool balance is correct

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!