Beedle - Oracle free perpetual lending

Summary

Avoid state changes after transfer calls to prevent re-entrancy vulnerabilities.

Vulnerability Details

The Lender contract has several potential re-entrancy vulnerabilities due to state variables being written after external calls to transfer tokens. This could allow an attacker to re-enter the function before it is updated. The affected functions are borrow(), buyLoan(), giveLoan(), refinance(), repay(), seizeLoan(), and setPool(). Careful checks should be added to prevent re-entrancy.

The Staking contract claim() function is vulnerable to re-entrancy due to updating the balance state variable after transferring tokens. This could allow an attacker to drain funds. Protections need to be added.

Impact

All funds can be drained from the contract.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, use OpenZeppelin's re-entrancy guard in both contracts and avoid updating the balance state variable after transferring tokens.