Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium

`Lender.buyLoan()` ,`Lender.giveLoan()` does not update `auctionLength` of loan to `auctionLength` of new pool.

RugpullDetector

Summary

When loan is bought by new lender or given by old lender, new loan will be originated from new pool.

So, it should update auctionLength to new pool's auctionLength

Vulnerability Details

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L416-L420

loans[loanId].lender = pool.lender;
loans[loanId].interestRate = pool.interestRate;
loans[loanId].startTimestamp = block.timestamp;
loans[loanId].auctionStartTimestamp = type(uint256).max;
loans[loanId].debt = totalDebt;

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L518-L522

loans[loanId].lender = msg.sender;
loans[loanId].interestRate = pools[poolId].interestRate;
loans[loanId].startTimestamp = block.timestamp;
loans[loanId].auctionStartTimestamp = type(uint256).max;
loans[loanId].debt = totalDebt;

Impact

New auction length will not be same as specified in pool after calling buyLoan() or giveLoan()

Tools Used

Manual Review

Recommendations

Lender.buyLoan() ,Lender.giveLoan() should update auctionLength to pool's auctionLength.

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L416-L420

loans[loanId].lender = pool.lender;
loans[loanId].interestRate = pool.interestRate;
loans[loanId].startTimestamp = block.timestamp;
loans[loanId].auctionStartTimestamp = type(uint256).max;
loans[loanId].debt = totalDebt;
+ loans[loanId].auctionLength = pool.auctionLength // @audit - auction length update

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L518-L522

loans[loanId].lender = msg.sender;
loans[loanId].interestRate = pools[poolId].interestRate;
loans[loanId].startTimestamp = block.timestamp;
loans[loanId].auctionStartTimestamp = type(uint256).max;
loans[loanId].debt = totalDebt;
+ loans[loanId].auctionLength = pools[poolId].auctionLength // @audit - auction length update

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.