Beedle - Oracle free perpetual lending

Summary

Malicious lender can lock borrowers' funds forever by changing the collateral token

Vulnerability Details

If we take a look at the setPool() function, we'll notice that this function allows lenders to change the collateral token. However, doing so can make the borrower unable to repay their debt.

The repay function includes a call to getPoolId(), which generates a distinct hash value. Subsequently, the variable 'poolId' is assigned this hash, referring to a different pool. As the 'poolId' now points to another pool, the 'outstandingLoans' associated with this pool would be zero. Consequently, the attempt to execute the transaction would fail due to an underflow condition when the following operation is performed

Impact

Borrower may be unable to repay their debt

Tools Used

Manual Review

Recommendations

Restrict lender from changing a collateral token